Skip to content
skillsafebeta
← Report library
Purpose / Other

Face Swap Skill Security Audit

What the author says it does (original text)

>

Independent security check

Do not install or run it yet

Files checked
1
Risks found
6
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installation directly executes or globally installs third-party npm packages

Source references: 3
What we found

The instructions recommend `npm i -g`, which changes global Node.js tooling, or `npx -y`, which automatically downloads and executes the currently resolved package. No version, checksum, or package contents are fixed in the evidence, and the Skill installation command executes another package through npx.

Why this matters

If the npm package, a dependency, or the resolved version is compromised, installation code runs with the user's privileges and can access files and credentials available to that account. A global install also leaves executables on the system.

The documentation offers both a global installation of a third-party CLI and an `npx -y` alternative that automatically downloads and runs it; neither pins a version or supplies a checksum. A separate `npx` command installs the skill. Running these steps executes whatever npm resolves at that time and may modify global tools or skill directories. Users can isolate execution and request pinned versions and integrity information.

SKILL.md:32In the instructionsOpen original file
```bash# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version# 2. Sign inruncomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>
Show 2 other places
SKILL.md:47In the instructionsOpen original file
## Install this skill```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill face-swap -g```
SKILL.md:303In the instructionsOpen original file
- **Consent**: see the "Consent & disclosure" section above. Face-swap is dual-use and the skill does not gate inputs — the responsibility rests with the operator. **Refuse user requests that target real people without consent**, or that aim at defamatory / sexually explicit / otherwise harmful synthetic media, regardless of what the CLI accepts.- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

Faces, voices, and performance media are processed by an external model service

Source references: 3
What we found

The CLI sends a request containing asset URLs to RunComfy's Model API, which must retrieve the referenced face images, audio, or videos to generate the result. These assets can identify people through their face, voice, and movements.

Why this matters

RunComfy and potentially its upstream model providers may receive sensitive likenesses or unreleased media. The Skill gives no retention period, training policy, deletion process, processing location, or identity of upstream recipients, so users cannot determine downstream handling from this document.

The live commands place face-image, audio, or performance-video HTTPS URLs in requests, and the documentation says the CLI POSTs to RunComfy’s Model API. The external service therefore receives the asset locations and processes potentially identifiable data. Users should submit only authorized material suitable for third-party processing and ask about retention, access, and deletion policies.

SKILL.md:112In the instructionsOpen original file
```bashruncomfy run community/wan-2-2-animate/api \  --input '{    "image_url": "https://your-cdn.example/new-character.png",    "audio_url": "https://your-cdn.example/voiceover.mp3"  }' \  --output-dir ./out```
Show 2 other places
SKILL.md:138In the instructionsOpen original file
```bashruncomfy run kling/kling-2-6/motion-control-pro \  --input '{    "reference_video_url": "https://your-cdn.example/source-performance.mp4",    "character_image_url": "https://your-cdn.example/target-character.png"  }' \  --output-dir ./out```
SKILL.md:298In the instructionsOpen original file
The skill classifies user intent — video vs still, motion-preserving vs identity-preserving, single shot vs batch, photoreal vs stylized — and picks one of the five routes. It then invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls request status, fetches the result, and downloads any `.runcomfy.net` / `.runcomfy.com` URLs into `--output-dir`.
Low risk

Login persists an API token in the user's configuration directory

Source references: 2
What we found

A normal login writes the API token to `~/.config/runcomfy/token.json`. Although the document says the file mode is 0600, the token remains as a persistent file and can be read by processes running as the same user.

Why this matters

Malware, compromised developer tools running under the same account, or backups that mistakenly include the directory could obtain the token and use its RunComfy account permissions.

Normal login persistently writes the API token under the user’s configuration directory. Mode 0600 blocks other system users but does not protect it from malicious or compromised processes running as the same account. Users can prefer a temporary environment variable in isolated CI/containers and ask about token lifetime, revocation, and least-privilege scope.

SKILL.md:36In the instructionsOpen original file
# 2. Sign inruncomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>
Show 1 other places
SKILL.md:304In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers.- **Input boundary (shell injection)**: prompts and asset URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content. **No shell-injection surface**.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

The declared Bash scope contradicts the actual installation instructions

Source references: 4
What we found

Metadata permits only `Bash(runcomfy *)`, and the security section says the Skill never instructs anything else, yet the same file explicitly directs users to run `npm` and `npx`. The permission summary therefore does not cover all command execution needed to follow the document.

Why this matters

A user or agent may approve the Skill based on its narrow permission declaration but then execute broader package-manager commands that download and run code. This weakens permission-based review and approval decisions.

Metadata authorizes only `runcomfy` Bash commands, and the security section says the skill never instructs anything else, yet the body explicitly gives `npm` and `npx` installation commands. Even if intended as manual prerequisites, that distinction is not stated in the permission declaration, so it does not describe the full setup flow. Users can restrict the agent to `runcomfy` and separately review and perform installation.

SKILL.md:4In the instructionsOpen original file
displayName: "Face Swap"allowed-tools: Bash(runcomfy *)description: >
Show 3 other places
SKILL.md:33In the instructionsOpen original file
```bash# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version
SKILL.md:49In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill face-swap -g```
SKILL.md:311In the instructionsOpen original file
- **Generated-file size cap**: the CLI aborts any single download > 2 GiB.- **Scope of bash usage**: declared `allowed-tools: Bash(runcomfy *)`. The skill never instructs the agent to run anything other than `runcomfy <subcommand>`.
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The install command uses a repository reference without a version. A later run could resolve to changed skill content. The user can ask for a pinned release or commit hash and verify the package source and contents before installation.

SKILL.md:50In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill face-swap -g```
Show 1 other places
SKILL.md:49In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill face-swap -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
High risk

Text-only warnings do not prevent non-consensual impersonation or harmful deepfakes

Source references: 4
What we found

The Skill is designed to substitute identities and expressly says it has no gate and the API will process whatever inputs are supplied. Refusal is only an instruction to the agent; there is no technical consent check, output watermark, or publication restriction.

Why this matters

If an operator, a prompt-influenced agent, or another automated workflow ignores the warning, outputs could support spokesperson impersonation, defamation, fraud, or non-consensual synthetic media, causing reputational, legal, and commercial harm.

The skill can substitute a real person’s identity and explicitly says it does not gate inputs and the API will process supplied material. Although the text requires rights checks and refusal of non-consensual or harmful requests, no technical consent verification or publication control is shown. If an agent disregards those text rules, impersonating, defamatory, or sexual deepfakes could be generated. Users can ask about enforceable consent checks, labeling, and abuse controls.

SKILL.md:55In the instructionsOpen original file
**Face-swap is dual-use.** Before invoking any route in this skill, confirm:- You have rights to the target face (the identity being substituted **in**).- You have rights to the source video / image (the asset being substituted **into**).- The output's intended platform allows synthetic media. Many do; many require a disclosure label.The skill itself doesn't gate anything — the model API will run whatever inputs you supply. **The responsibility is yours.** If a user asks the agent to swap a real public figure's face onto material that could be defamatory, sexually explicit, or otherwise harmful — **refuse**, regardless of what the CLI accepts.
Show 3 other places
SKILL.md:252In the instructionsOpen original file
### Cast a brand spokesperson into existing footage- **Route 1 (Wan 2-2 Animate)** with the new spokesperson's portrait + the original audio track
SKILL.md:302In the instructionsOpen original file
- **Consent**: see the "Consent & disclosure" section above. Face-swap is dual-use and the skill does not gate inputs — the responsibility rests with the operator. **Refuse user requests that target real people without consent**, or that aim at defamatory / sexually explicit / otherwise harmful synthetic media, regardless of what the CLI accepts.- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.
SKILL.md:61In the instructionsOpen original file
The skill itself doesn't gate anything — the model API will run whatever inputs you supply. **The responsibility is yours.** If a user asks the agent to swap a real public figure's face onto material that could be defamatory, sexually explicit, or otherwise harmful — **refuse**, regardless of what the CLI accepts.

Inside this skill

8 instruction sections

This Skill is a routing guide: it selects one of five RunComfy models based on still-image, video, motion-preservation, or batch needs, then uses the CLI to submit JSON to the Model API, poll the job, and download results to the chosen directory.

View source
SKILL.md:296In the instructionsOpen original file
## How it worksThe skill classifies user intent — video vs still, motion-preserving vs identity-preserving, single shot vs batch, photoreal vs stylized — and picks one of the five routes. It then invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls request status, fetches the result, and downloads any `.runcomfy.net` / `.runcomfy.com` URLs into `--output-dir`.

Inputs include HTTPS URLs for face references, scene images, audio, or performance videos; different routes can combine identity, voice-driven animation, or body motion in the generated result.

View source
SKILL.md:107In the instructionsOpen original file
The featured RunComfy endpoint for character swap — supply a reference image of the new identity + the audio track the character should speak, and the model produces a video where the character drives.
SKILL.md:133In the instructionsOpen original file
Different from a pure face-swap: Motion Control takes a **reference performance video** (the motion you want) and a **target character image** (the identity you want), and produces a video of the target performing the reference motion. The face-swap effect is a byproduct.
SKILL.md:158In the instructionsOpen original file
For **still images**, GPT Image 2 Edit accepts up to **10 reference images** and follows precise compositional instructions — making it the strongest path for multi-ref face swap on a single output frame.

The documentation asks the operator to confirm identity and source-media rights and platform disclosure rules, while explicitly stating that neither the Skill nor the model API enforces those checks.

View source
SKILL.md:55In the instructionsOpen original file
**Face-swap is dual-use.** Before invoking any route in this skill, confirm:- You have rights to the target face (the identity being substituted **in**).- You have rights to the source video / image (the asset being substituted **into**).- The output's intended platform allows synthetic media. Many do; many require a disclosure label.The skill itself doesn't gate anything — the model API will run whatever inputs you supply. **The responsibility is yours.** If a user asks the agent to swap a real public figure's face onto material that could be defamatory, sexually explicit, or otherwise harmful — **refuse**, regardless of what the CLI accepts.
Start here · InstructionsSKILL.md
face-swap
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 7 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:4In the instructionsOpen original file
displayName: "Face Swap"allowed-tools: Bash(runcomfy *)description: >
SKILL.md:32In the instructionsOpen original file
```bash# 1. Install (see runcomfy-cli skill for details)
SKILL.md:49In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill face-swap -g
Connect to websites
SKILL.md:20In the instructionsOpen original file
  ask to substitute one identity for another.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:28In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=face-swap) · [Character-swap feature](https://www.runcomfy.com/models/feature/character-swap?utm_source=skills.sh&utm_medium=skill&utm_campaign=face-swap) · [CLI docs](https://docs.runcomfy.com/cli/introduction?utm_source=skills.sh&utm_medium=skill&utm_campaign=face-swap)
SKILL.md:45In the instructionsOpen original file
CLI deep dive: [`runcomfy-cli`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/runcomfy-cli) skill.
Install extra software packages
SKILL.md:34In the instructionsOpen original file
# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version
SKILL.md:50In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill face-swap -g```
SKILL.md:303In the instructionsOpen original file
- **Consent**: see the "Consent & disclosure" section above. Face-swap is dual-use and the skill does not gate inputs — the responsibility rests with the operator. **Refuse user requests that target real people without consent**, or that ai …- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers.
Lines read
321
File checksum (to compare versions)
2d7e8cba2b21b251998b24418772f2ff1e5ac0c5ec361909b93a1c89127f8ae8