Skip to content
skillsafebeta
← Report library
Purpose / Other

Video Edit Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 2
Medium risk

The prerequisite globally installs and runs third-party npm software

Source references: 3
What we found

`npm i -g @runcomfy/cli` downloads software from npm, runs its installation lifecycle with the current user's privileges, and leaves an executable in the global npm location. The package version is not pinned, and its implementation is not included for this review.

Why this matters

If the published package, a dependency, or a future version is compromised, installation or later execution could read accessible files and environment variables, modify user-level configuration, or use the stored RunComfy token. A global install also creates a lasting system change.

The prerequisite globally installs an unversioned third-party CLI from npm, then uses it for login and job submission. This places software in the user's global npm location, while the supplied material contains no CLI implementation with which to verify install scripts or runtime behavior. Users can request a pinned version and integrity value, and inspect it first in an isolated, low-privilege environment.

SKILL.md:49In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login`.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.4. **A source video URL** — formats and limits depend on the chosen route.
Show 2 other places
SKILL.md:217In the instructionsOpen original file
The skill picks one of Wan 2.7 Edit-Video / Kling 2.6 Pro Motion Control / Lucy Edit Restyle based on user intent and invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:47In the instructionsOpen original file
## Prerequisites1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login`.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.4. **A source video URL** — formats and limits depend on the chosen route.
Medium risk

The claimed absence of shell injection overlooks parsing before the CLI starts

Source references: 3
What we found

The examples place the full JSON value inside a single-quoted shell argument while the prompt is user-controlled. The CLI may avoid expanding the string it receives, but the shell parses the command first; directly inserting a prompt containing a single quote or shell syntax can terminate the argument boundary. One apostrophe is manually escaped in an example, but no general safe argument-construction method is required.

Why this matters

Unsafe command construction could alter CLI arguments and, in severe cases, execute local shell commands embedded in a prompt, exposing or changing files and credentials available to the agent.

What this evidence establishes

The material claims there is no prompt-based shell-injection surface, but only shows JSON embedded in a single-quoted shell argument, with one apostrophe manually escaped. If arbitrary prompts are inserted into such a command, the shell parses them before the CLI receives them and faulty escaping could alter command boundaries. No command-construction implementation is supplied, so the defect cannot be confirmed. Users can ask for evidence that an argument array or temporary JSON file is used instead of shell-string concatenation.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:77In the instructionsOpen original file
```bashruncomfy run wan-ai/wan-2-7/edit-video \  --input '{    "prompt": "Preserve the speaker'\''s face, pose, and lip movement; change the background to a modern office with neutral lighting.",    "video": "https://.../speaker.mp4",    "audio_setting": "origin"  }' \  --output-dir <absolute/path>```
Show 2 other places
SKILL.md:222In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.
SKILL.md:78In the instructionsOpen original file
```bashruncomfy run wan-ai/wan-2-7/edit-video \  --input '{    "prompt": "Preserve the speaker'\''s face, pose, and lip movement; change the background to a modern office with neutral lighting.",    "video": "https://.../speaker.mp4",    "audio_setting": "origin"  }' \  --output-dir <absolute/path>```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Videos, images, audio, and edit prompts are processed by RunComfy's remote service

Source references: 4
What we found

Each route places source videos, character images, motion-reference videos, and prompts in a request sent to the Model API; the server then fetches the media URLs. Faces, voices, movement, unreleased packaging, or private URLs containing signed parameters may consequently be disclosed to a third party.

Why this matters

RunComfy gains access to the job and its media. For personal, biometric, client, or confidential commercial material, this expands who controls the data and may conflict with consent, confidentiality, or data-residency requirements.

The skill explicitly submits prompts and media URLs to RunComfy's Model API, and says RunComfy's server fetches supplied image, mask, or video URLs. People’s media, audio, confidential designs, and access-bearing URLs would therefore be disclosed to a third-party service. Users can limit submissions to authorized, sanitized material, use short-lived URLs, and ask for retention, training-use, and deletion policies.

SKILL.md:121In the instructionsOpen original file
| `prompt` | string | yes | Describe target motion / style. || `image` | string | yes (image orientation) | Reference for character / background consistency. || `video` | string | yes | **Motion reference**. 10–30s depending on orientation. || `keep_original_sound` | bool | no | Preserve audio from reference video. || `character_orientation` | enum | yes | `image` (max 10s output) or `video` (max 30s output). |
Show 3 other places
SKILL.md:217In the instructionsOpen original file
The skill picks one of Wan 2.7 Edit-Video / Kling 2.6 Pro Motion Control / Lucy Edit Restyle based on user intent and invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:223In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.
SKILL.md:120In the instructionsOpen original file
|---|---|---|---|| `prompt` | string | yes | Describe target motion / style. || `image` | string | yes (image orientation) | Reference for character / background consistency. || `video` | string | yes | **Motion reference**. 10–30s depending on orientation. || `keep_original_sound` | bool | no | Preserve audio from reference video. || `character_orientation` | enum | yes | `image` (max 10s output) or `video` (max 30s output). |
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The installation example adds the skill from a GitHub repository without pinning a commit hash, tag, or version. Running the same command later could retrieve changed upstream content, so the installed material may differ from what was reviewed here. A user can ask for an immutable commit hash and inspect that revision before installation.

SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill video-edit -g```
Show 1 other places
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill video-edit -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is a routing guide: it selects Wan, Kling, or Lucy from the requested edit, then uses the local RunComfy CLI to submit JSON to a remote Model API, poll the job, and download generated files.

View source
SKILL.md:217In the instructionsOpen original file
The skill picks one of Wan 2.7 Edit-Video / Kling 2.6 Pro Motion Control / Lucy Edit Restyle based on user intent and invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.

Use requires installing a third-party npm CLI and supplying RunComfy credentials through interactive login or an environment variable. Login mode persistently stores the token under the user's home directory.

View source
SKILL.md:49In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login`.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.4. **A source video URL** — formats and limits depend on the chosen route.
SKILL.md:221In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.

Media is submitted by URL rather than processed solely on the user's machine; the instructions explicitly say RunComfy's model server fetches those URLs. Only the Skill document is supplied, not the CLI implementation, so its claimed domain allowlist, absence of telemetry, and download cap cannot be independently verified from this evidence.

View source
SKILL.md:223In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.
Start here · InstructionsSKILL.md
video-edit
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 1 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:17In the instructionsOpen original file
  "outfit swap video", or any explicit ask to transform a video.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:23In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=video-edit) · [Wan 2.7 Edit-Video](https://www.runcomfy.com/models/wan-ai/wan-2-7/edit-video?utm_source=skills.sh&utm_medium=skill&utm_campaign=video-edit) · [Kling Motion-Control Pro](https://www.runcomfy.com/models/kling/kling-2-6/motion-control-pro?utm_source=skills.sh&utm_medium=skill&utm_campaign=video-edit) · [Lucy Edit Restyle](https://www.runcomfy.com/models/decart/lucy-edit/restyle?utm_source=skills.sh&utm_medium=skill&utm_campaign=video-edit) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/video-edit)
SKILL.md:81In the instructionsOpen original file
    "prompt": "Preserve the speaker'\''s face, pose, and lip movement; change the background to a modern office with neutral lighting.",    "video": "https://.../speaker.mp4",    "audio_setting": "origin"
Run commands
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill video-edit -g
SKILL.md:77In the instructionsOpen original file
```bashruncomfy run wan-ai/wan-2-7/edit-video \
SKILL.md:89In the instructionsOpen original file
```bashruncomfy run wan-ai/wan-2-7/edit-video \
Install extra software packages
SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill video-edit -g```
Lines read
226
File checksum (to compare versions)
a985e9899ff95bc1c112baa42ec19bdb680ee7153db617a9936a547f500002df