Skip to content
skillsafebeta
← Report library
Purpose / Other

Ace Step Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installing and authenticating a third-party npm CLI runs its code with user access and exposes an account token to it

Source references: 4
What we found

The instructions use either a global npm installation or `npx -y` to automatically retrieve and execute `@runcomfy/cli`, then use that program for login. The supplied material does not include the CLI implementation, so its install scripts, file access, and token handling cannot be verified against these claims.

Why this matters

If the package, publisher account, or a dependency is compromised, its code could read files or environment variables available to the current user and potentially misuse the RunComfy token and account balance.

The instructions explicitly download and execute a third-party npm CLI, then authenticate through it or supply a token via an environment variable. This is disclosed and necessary for the music service, but no CLI source is provided to verify install scripts, file access, or token-handling claims. Users can isolate it, pin a version, and limit token permissions and spending.

SKILL.md:38In the instructionsOpen original file
**Step 1 — install** (one of, see the `runcomfy-cli` skill for details):```bashnpm i -g @runcomfy/cli         # global installnpx -y @runcomfy/cli --version # zero-install```**Step 2 — sign in** (or set `RUNCOMFY_TOKEN` env var in CI / containers):```bashruncomfy login```
Show 3 other places
SKILL.md:322In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf** — if the operator wants the curl-pipe path documented at `docs.runcomfy.com/cli/install`, they should review the script first.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers. Never echo the token into a prompt, log it, or check it in.- **Input boundary (shell injection)**: prompts and audio URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content; it transmits the JSON body directly to the Model API over HTTPS. **No shell-injection surface from prompt content**.
SKILL.md:41In the instructionsOpen original file
```bashnpm i -g @runcomfy/cli         # global installnpx -y @runcomfy/cli --version # zero-install```
SKILL.md:45In the instructionsOpen original file
**Step 2 — sign in** (or set `RUNCOMFY_TOKEN` env var in CI / containers):```bashruncomfy login```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Audio URLs, creative prompts, and lyrics are sent to the remote RunComfy service

Source references: 3
What we found

The CLI POSTs the matching JSON body to the RunComfy Model API. Editing requires an audio HTTPS URL, so the remote service learns that URL and must access its referenced audio to perform the operation; tags and lyrics are also part of the request body. No server-side retention, reuse, or deletion policy is provided.

Why this matters

Unreleased music, protected lyrics, creative direction, or a signed URL containing access credentials may be disclosed to a third party. An overly broad or long-lived URL could also extend access to the source audio.

Generation POSTs the JSON body to RunComfy's Model API, and editing bodies contain an audio URL, tags, and optional lyrics. The service therefore receives those values and may need to fetch the referenced audio. The material states endpoints and HTTPS transport but provides no server-side retention, training-use, or deletion policy; sensitive or unauthorized material should not be submitted without clarifying those terms.

SKILL.md:151In the instructionsOpen original file
|---|---|---|---|---|| `audio` | string | yes | — | HTTPS URL to MP3 / WAV / FLAC. Up to 60 min || `tags` | string | yes | — | Comma-separated tags steering the regenerated segment || `start_time` | float | no | — | Start of editable segment, in seconds (0–240) || `start_time_relative_to` | enum | no | `start` | `start` or `end` — anchor for `start_time` || `end_time` | float | no | `30` | End of editable segment, in seconds (0–240) || `end_time_relative_to` | enum | no | `start` | `start` or `end` — anchor for `end_time` || `lyrics` | string | no | — | Lyrics for the regenerated segment. Blank = model writes; `[inst]` = no vocals || `seed` | int | no | `-1` | Reproducibility |
Show 2 other places
SKILL.md:317In the instructionsOpen original file
The skill picks one of the four ACE Step endpoints based on the user's intent — generate from scratch (t2a base or 1.5), regenerate a time range (inpaint), or extend the canvas (outpaint) — and invokes `runcomfy run` with the matching JSON body. The CLI POSTs to the RunComfy Model API, polls request status, and downloads the generated audio file into `--output-dir`.
SKILL.md:328In the instructionsOpen original file
- **Lyrics provenance**: if the user supplies lyrics, confirm they have the rights. Generating music around copyrighted lyrics is the operator's responsibility.- **Outbound endpoints (allowlist)**: only `model-api.runcomfy.net` and `*.runcomfy.net` / `*.runcomfy.com`. No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

Neither the Skill nor its underlying CLI is installed at a pinned version, so a future run may retrieve code different from what was reviewed. These are disclosed one-time setup commands, not hidden runtime installation; a user can ask for a pinned version and integrity hash.

SKILL.md:33In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill ace-step -g```
Show 1 other places
SKILL.md:41In the instructionsOpen original file
```bashnpm i -g @runcomfy/cli         # global installnpx -y @runcomfy/cli --version # zero-install```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Low risk

Each remote generation incurs duration-based charges that accumulate across batches or chained calls

Source references: 5
What we found

The Skill uses paid endpoints and chooses between models priced at $0.0002 and $0.0003 per second based on intent. It also suggests chaining calls beyond per-call limits, so total cost depends on model version, duration, retries, and batch size.

Why this matters

Individual requests are inexpensive, but large draft sets, multilingual variants, automatic retries, or chained extensions can steadily consume the account balance; version 1.5 costs more than the base version.

The documentation prices output per generated second and recommends both batch generation and chained calls beyond one-call limits, so multiple tracks, long audio, or repeated attempts accumulate charges. Version 1.5 is presented as a choice for particular needs, not an unconditional automatic upgrade, and the source does not show automatic retries. Users can require a model/duration/cost preview and set an account spending cap.

SKILL.md:67In the instructionsOpen original file
**ACE Step 1.5 (text-to-audio)** — `acestep-ai/ace-step-1.5/text-to-audio`> Latest ACE Step generation. **50+ language vocal support**, refined structured-lyric handling, otherwise same shape as base. Slightly higher cost ($0.0003/s vs $0.0002/s).> Pick for: multilingual lyrics, hero-quality vocal tracks, vocal songs that need clean section structure.> Avoid for: cost-sensitive batches where the base model is good enough.
Show 4 other places
SKILL.md:102In the instructionsOpen original file
**Pricing**: ACE Step $0.0002/s · ACE Step 1.5 $0.0003/s. 60 s ≈ $0.012 / $0.018; 240 s ≈ $0.048 / $0.072.
SKILL.md:82In the instructionsOpen original file
**ACE Step (audio-outpaint)** — `acestep-ai/ace-step/audio-outpaint`> Extend an existing track **bidirectionally** — add intro before, outro after, or both.> Pick for: lengthening a 30 s draft into a 2 min cut, adding a fade-in, building a longer arrangement around an existing hook.> Avoid for: extending a track past 4 min total — chain calls instead.
SKILL.md:85In the instructionsOpen original file
> Pick for: lengthening a 30 s draft into a 2 min cut, adding a fade-in, building a longer arrangement around an existing hook.> Avoid for: extending a track past 4 min total — chain calls instead.
SKILL.md:277In the instructionsOpen original file
### Cost-sensitive background music library- **Route 1 (ACE Step base)** with varied tag combos, 60–90 s each, `[inst]`

Inside this skill

8 instruction sections

The Skill signs in through the third-party RunComfy CLI, sends generation parameters to the RunComfy Model API, polls the job, and downloads the generated audio to the selected directory.

View source
SKILL.md:45In the instructionsOpen original file
**Step 2 — sign in** (or set `RUNCOMFY_TOKEN` env var in CI / containers):```bashruncomfy login```
SKILL.md:317In the instructionsOpen original file
The skill picks one of the four ACE Step endpoints based on the user's intent — generate from scratch (t2a base or 1.5), regenerate a time range (inpaint), or extend the canvas (outpaint) — and invokes `runcomfy run` with the matching JSON body. The CLI POSTs to the RunComfy Model API, polls request status, and downloads the generated audio file into `--output-dir`.

It supports text-to-music generation and editing existing audio supplied through an HTTPS URL, either regenerating a time range or extending the beginning or end; an editing input may reference up to 60 minutes of audio.

View source
SKILL.md:77In the instructionsOpen original file
**ACE Step (audio-inpaint)** — `acestep-ai/ace-step/audio-inpaint`> Regenerate a **time range** inside an existing track (not mask-based; uses `start_time` / `end_time` in seconds, each anchored to track start or end).> Pick for: fix a bad chorus in the middle, swap the bridge, replace a 20 s section without re-rendering the whole song.> Avoid for: edits that aren't time-bounded — those don't fit the schema.**ACE Step (audio-outpaint)** — `acestep-ai/ace-step/audio-outpaint`> Extend an existing track **bidirectionally** — add intro before, outro after, or both.> Pick for: lengthening a 30 s draft into a 2 min cut, adding a fade-in, building a longer arrangement around an existing hook.
SKILL.md:151In the instructionsOpen original file
|---|---|---|---|---|| `audio` | string | yes | — | HTTPS URL to MP3 / WAV / FLAC. Up to 60 min || `tags` | string | yes | — | Comma-separated tags steering the regenerated segment |

The authentication token may be persisted in the user's configuration directory by the login command or supplied through the RUNCOMFY_TOKEN environment variable; the document states that the stored file uses mode 0600.

View source
SKILL.md:322In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf** — if the operator wants the curl-pipe path documented at `docs.runcomfy.com/cli/install`, they should review the script first.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers. Never echo the token into a prompt, log it, or check it in.- **Input boundary (shell injection)**: prompts and audio URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content; it transmits the JSON body directly to the Model API over HTTPS. **No shell-injection surface from prompt content**.

Requests are billed by generated or extended audio duration; the stated rates are $0.0002 per second for the base model and $0.0003 per second for version 1.5.

View source
SKILL.md:102In the instructionsOpen original file
**Pricing**: ACE Step $0.0002/s · ACE Step 1.5 $0.0003/s. 60 s ≈ $0.012 / $0.018; 240 s ≈ $0.048 / $0.072.
Start here · InstructionsSKILL.md
ace-step
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 5 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:4In the instructionsOpen original file
displayName: "ACE Step — Pro Pack on RunComfy"allowed-tools: Bash(runcomfy *)description: >
SKILL.md:32In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill ace-step -g
SKILL.md:40In the instructionsOpen original file
```bashnpm i -g @runcomfy/cli         # global install
Connect to websites
SKILL.md:20In the instructionsOpen original file
  music with ACE Step.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:28In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=ace-step) · [ACE Step base](https://www.runcomfy.com/models/acestep-ai/ace-step/text-to-audio?utm_source=skills.sh&utm_medium=skill&utm_campaign=ace-step) · [ACE Step 1.5](https://www.runcomfy.com/models/acestep-ai/ace-step-1.5/text-to-audio?utm_source=skills.sh&utm_medium=skill&utm_campaign=ace-step) · [CLI docs](https://docs.runcomfy.com/cli/introduction?utm_source=skills.sh&utm_medium=skill&utm_campaign=ace-step)
SKILL.md:59In the instructionsOpen original file
CLI deep dive: [`runcomfy-cli`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/runcomfy-cli) skill.
Install extra software packages
SKILL.md:33In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill ace-step -g```
SKILL.md:42In the instructionsOpen original file
npm i -g @runcomfy/cli         # global installnpx -y @runcomfy/cli --version # zero-install```
SKILL.md:321In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf** — if the operator wants the curl-pipe path documented at `docs.runcomfy.com/cli/install`, they should review the script first.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers. Never echo the token into a prompt, log it, or check it in.
Lines read
338
File checksum (to compare versions)
b81ea3a56969fd8a9702d8ab47282defefac08f3d173512525d3ebf8251b1926