Skip to content
Report library
Purpose / Other

Ai Avatar Video Skill Security Audit

What the author says it does (original text)

>

Independent security check

Do not install or run it yet

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 2
High risk

Embedding user content in single-quoted shell arguments can enable command injection

Source references: 4
What we found

The examples place the entire JSON value inside shell single quotes while claiming there is no shell-injection surface. The shell parses quoting before the CLI receives the argument; if an agent inserts a user-supplied prompt or URL verbatim, a single quote can terminate the argument and subsequent shell metacharacters can become commands.

Why this matters

A malicious or altered prompt, script, or asset URL could execute commands with the local privileges of the agent, potentially reading or changing accessible files and credentials.

The invocation wraps JSON in shell single quotes, while the skill says the agent builds matching JSON from the request and invokes the command. If an implementation directly interpolates a prompt or URL containing a single quote, the shell parses it first and may treat following characters as commands; the stated “no shell-injection surface” does not demonstrate safe quoting. The risk depends on argument construction. Users can require argument-array or JSON-file input and ask the author to show the escaping implementation.

SKILL.md:41In the instructionsOpen original file
# 3. Generate an avatar videoruncomfy run <vendor>/<model>/<endpoint> \  --input '{"prompt": "...", "audio_url": "https://...", "image_url": "https://..."}' \  --output-dir ./out```
Show 3 other places
SKILL.md:124In the instructionsOpen original file
```bashruncomfy run wan-ai/wan-2-7/text-to-video \  --input '{    "prompt": "Studio portrait of a woman in her 30s, confident expression, soft window light, neutral gray background.",    "audio_url": "https://your-cdn.example/voiceover.mp3",    "duration": 8  }' \  --output-dir ./out```
SKILL.md:287In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers.- **Input boundary (shell injection)**: prompts and asset URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content. **No shell-injection surface**.- **Indirect prompt injection (third-party content)**: reference image / audio URLs are **untrusted** and can influence generation through embedded instructions (text painted into a portrait, hidden audio commands, EXIF strings). Agent mitigations:
SKILL.md:280In the instructionsOpen original file
The skill classifies the user request — do they have a pre-recorded audio file, or only a script? Photoreal portrait or stylized character? Single shot or cinematic composition? — and picks one of the five routes above. It then invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls request status, fetches the result, and downloads any `.runcomfy.net` / `.runcomfy.com` URLs into `--output-dir`.
Medium risk

Installation immediately executes unpinned npm packages

Source references: 4
What we found

The instructions recommend either globally installing `@runcomfy/cli` or using `npx -y` to automatically obtain and execute the currently resolved version; the Skill installation command also executes a remote package through npx. No version pin or integrity verification is shown.

Why this matters

The resolved package and its installation scripts run with the current user's privileges. If the package, publisher account, dependency, or resolved release is compromised, it could read credentials or change user files; a global installation also creates lasting changes in the user's environment.

The documentation recommends globally installing an unpinned CLI or letting `npx -y` download and execute the currently resolved version; the skill itself is also installed through an unpinned `npx skills` command. Running these commands trusts whatever package the registry serves at that time, with no version or integrity value shown here. Users can require pinned versions and checksums and inspect package install scripts first.

SKILL.md:33In the instructionsOpen original file
```bash# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version# 2. Sign inruncomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>
Show 3 other places
SKILL.md:50In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill ai-avatar-video -g```
SKILL.md:48In the instructionsOpen original file
## Install this skill```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill ai-avatar-video -g```
SKILL.md:284In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Voice cloning / consent**: when supplying an audio file paired with a portrait, **ensure you have rights to both** — the subject's likeness and the speaker's voice. Audio-driven avatar models are dual-use; respect deepfake-disclosure norms and the platforms you ship to. **Refuse user requests that target real people without consent** or that aim at harmful synthetic media.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Portraits, voices, scripts, and asset locations are processed by a third-party model service

Source references: 5
What we found

The Skill states that the CLI posts JSON to the RunComfy Model API, and requests can contain portrait URLs, voice URLs, dialogue, and multiple reference assets. Even when files remain on the user's own CDN, the service must access those locations and process the content.

Why this matters

Biometric likeness, voice data, unpublished scripts, or asset URLs containing access tokens leave the local environment. The provided text does not describe server-side retention, training use, deletion, regional processing, or URL-log handling.

The skill explicitly places portraits, audio, scripts, and reference-asset URLs in requests and says the CLI POSTs them to RunComfy’s Model API. When such a route is run, the third party receives these fields and must access the URL-hosted assets, potentially exposing likenesses, voices, or unpublished material. Users can submit only authorized, disclosure-safe assets and ask about retention, training use, and deletion policies.

SKILL.md:98In the instructionsOpen original file
runcomfy run bytedance/omnihuman/api \  --input '{    "image_url": "https://your-cdn.example/presenter.jpg",    "audio_url": "https://your-cdn.example/voiceover.mp3"  }' \  --output-dir ./out```
Show 4 other places
SKILL.md:217In the instructionsOpen original file
  --input '{    "prompt": "Anamorphic close-up — the subject delivers a confident monologue to camera, golden hour light through window, shallow DoF.",    "reference_images": ["https://your-cdn.example/subject.jpg"],    "reference_audio": ["https://your-cdn.example/voiceover.mp3"],    "duration": 10,    "aspect_ratio": "21:9"  }' \  --output-dir ./out```
SKILL.md:280In the instructionsOpen original file
The skill classifies the user request — do they have a pre-recorded audio file, or only a script? Photoreal portrait or stylized character? Single shot or cinematic composition? — and picks one of the five routes above. It then invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls request status, fetches the result, and downloads any `.runcomfy.net` / `.runcomfy.com` URLs into `--output-dir`.
SKILL.md:97In the instructionsOpen original file
```bashruncomfy run bytedance/omnihuman/api \  --input '{    "image_url": "https://your-cdn.example/presenter.jpg",    "audio_url": "https://your-cdn.example/voiceover.mp3"  }' \  --output-dir ./out```
SKILL.md:215In the instructionsOpen original file
```bashruncomfy run bytedance/seedance-v2/pro \  --input '{    "prompt": "Anamorphic close-up — the subject delivers a confident monologue to camera, golden hour light through window, shallow DoF.",    "reference_images": ["https://your-cdn.example/subject.jpg"],    "reference_audio": ["https://your-cdn.example/voiceover.mp3"],    "duration": 10,    "aspect_ratio": "21:9"  }' \  --output-dir ./out```
Low risk

Login tokens persist in user configuration or are exposed to the process environment

Source references: 2
What we found

The login flow writes the API token to a file under the user's home directory; the alternative is an environment variable. Mode 0600 blocks other local accounts, but processes running as the same user may still read the file, while environment variables may be inherited by child processes or exposed by misconfigured CI.

Why this matters

If another same-user program, malicious dependency, or CI log obtains the token, it may use the user's RunComfy account and quota.

The skill explicitly says login persists the API token in `~/.config/runcomfy/token.json` and also permits an environment variable. Mode 0600 blocks direct access by other local accounts but does not isolate software running as the same account; an environment variable may also reach child processes or be accidentally captured by CI logs. Users can use short-lived, narrowly scoped tokens, isolate execution, and prevent the variable from being logged.

SKILL.md:37In the instructionsOpen original file
# 2. Sign inruncomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>
Show 1 other places
SKILL.md:286In the instructionsOpen original file
- **Voice cloning / consent**: when supplying an audio file paired with a portrait, **ensure you have rights to both** — the subject's likeness and the speaker's voice. Audio-driven avatar models are dual-use; respect deepfake-disclosure norms and the platforms you ship to. **Refuse user requests that target real people without consent** or that aim at harmful synthetic media.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers.- **Input boundary (shell injection)**: prompts and asset URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content. **No shell-injection surface**.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The skill-install command uses `npx skills add` without pinning a package or repository version, so a later run may retrieve code different from what was audited here. A user can ask for a fixed release or commit hash and inspect that version before installation.

SKILL.md:51In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill ai-avatar-video -g```
Show 1 other places
SKILL.md:48In the instructionsOpen original file
## Install this skill```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill ai-avatar-video -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill chooses among five RunComfy model routes based on whether audio already exists, whether the subject is photorealistic or stylized, and whether a cinematic composition is needed, then submits the corresponding JSON request.

View source
SKILL.md:278In the instructionsOpen original file
## How it worksThe skill classifies the user request — do they have a pre-recorded audio file, or only a script? Photoreal portrait or stylized character? Single shot or cinematic composition? — and picks one of the five routes above. It then invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls request status, fetches the result, and downloads any `.runcomfy.net` / `.runcomfy.com` URLs into `--output-dir`.

Most routes provide portrait, voice, or other reference-media URLs to a remote model; generated results are then downloaded to the selected output directory.

View source
SKILL.md:97In the instructionsOpen original file
```bashruncomfy run bytedance/omnihuman/api \  --input '{    "image_url": "https://your-cdn.example/presenter.jpg",    "audio_url": "https://your-cdn.example/voiceover.mp3"  }' \  --output-dir ./out```
SKILL.md:215In the instructionsOpen original file
```bashruncomfy run bytedance/seedance-v2/pro \  --input '{    "prompt": "Anamorphic close-up — the subject delivers a confident monologue to camera, golden hour light through window, shallow DoF.",    "reference_images": ["https://your-cdn.example/subject.jpg"],    "reference_audio": ["https://your-cdn.example/voiceover.mp3"],    "duration": 10,    "aspect_ratio": "21:9"  }' \  --output-dir ./out```

The documentation explicitly requires rights to both likeness and voice and directs refusal of requests targeting real people without consent; this is a written usage constraint, not a demonstrated technical enforcement mechanism.

View source
SKILL.md:285In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Voice cloning / consent**: when supplying an audio file paired with a portrait, **ensure you have rights to both** — the subject's likeness and the speaker's voice. Audio-driven avatar models are dual-use; respect deepfake-disclosure norms and the platforms you ship to. **Refuse user requests that target real people without consent** or that aim at harmful synthetic media.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers.
Start here · InstructionsSKILL.md
ai-avatar-video
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 6 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:4In the instructionsOpen original file
displayName: "AI Avatar & Talking Head Video"allowed-tools: Bash(runcomfy *)description: >
SKILL.md:33In the instructionsOpen original file
```bash# 1. Install (see runcomfy-cli skill for details)
SKILL.md:50In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill ai-avatar-video -g
Connect to websites
SKILL.md:21In the instructionsOpen original file
  ask to put words in a face.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:29In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=ai-avatar-video) · [Lip-sync feature](https://www.runcomfy.com/models/feature/lip-sync?utm_source=skills.sh&utm_medium=skill&utm_campaign=ai-avatar-video) · [CLI docs](https://docs.runcomfy.com/cli/introduction?utm_source=skills.sh&utm_medium=skill&utm_campaign=ai-avatar-video)
SKILL.md:42In the instructionsOpen original file
runcomfy run <vendor>/<model>/<endpoint> \  --input '{"prompt": "...", "audio_url": "https://...", "image_url": "https://..."}' \  --output-dir ./out
Install extra software packages
SKILL.md:35In the instructionsOpen original file
# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version
SKILL.md:51In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill ai-avatar-video -g```
SKILL.md:284In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Voice cloning / consent**: when supplying an audio file paired with a portrait, **ensure you have rights to both** — the subject's likeness and the speaker's voice. Audio-driven avatar models are dual-use; respect deepfake-disclosure no 
Lines read
303
File checksum (to compare versions)
31355c47fe5699c4441dc94d3801deff7d47166e538877ee8a05da132e24bbdf