Skip to content
Report library
Purpose / Other

Happyhorse 1 0 Skill Security Audit

What the author says it does (original text)

>

Independent security check

Do not install or run it yet

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 2
High risk

Directly interpolating the user prompt into the example command can enable shell injection

Source references: 2
What we found

The example places the prompt inside a single-quoted JSON shell argument. If an agent substitutes a prompt containing an apostrophe, newline, or shell syntax, the shell can interpret escaped text before the CLI receives the JSON. The claim of “no shell injection surface” concerns CLI processing and does not remove this command-construction risk.

Why this matters

A malicious or accidentally crafted prompt could run local commands with the user's permissions, modifying or reading files, using logged-in accounts, or exposing credentials.

The example places `<user prompt>` inside a single-quoted JSON shell argument. If an agent builds this command by textual substitution, a quote in the prompt can terminate shell quoting and cause following text to be interpreted by the shell. Line 192 only describes behavior after input reaches the CLI and does not establish safe command construction. The risk depends on direct interpolation of the example.

SKILL.md:66In the instructionsOpen original file
```bashruncomfy run happyhorse/happyhorse-1-0/text-to-video \  --input '{"prompt": "<user prompt>"}' \  --output-dir <absolute/path>```
Show 1 other places
SKILL.md:192In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.
Medium risk

Prerequisites execute and globally install third-party npm software

Source references: 2
What we found

The documentation requires a global npm installation of the RunComfy CLI, while another example globally adds the Skill through npx. These operations download and execute third-party packages and persistently alter the user's global tool environment. Their implementation is absent, so its behavior cannot be verified from the supplied source.

Why this matters

If a package, dependency, or installation script is compromised, it can access files and credentials available to the installing user. A global installation can also change command versions used by unrelated projects.

The prerequisites require a global third-party CLI installation with `npm i -g`, and the Skill example also uses `npx ... -g`. These commands obtain external content and persistently alter the global environment; npm installation may also run package lifecycle scripts. Only documentation is supplied, not the CLI or installer implementation, so their actual behavior cannot be verified here.

SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill happyhorse-1-0 -g```
Show 1 other places
SKILL.md:44In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Prompts and an account token are sent to RunComfy

Source references: 3
What we found

The remote request contains the full user prompt and is authenticated with the user's bearer token. Video prompts may contain unreleased ideas, client material, personal information, or other sensitive content. The supplied material does not state server-side retention, training, or deletion rules.

Why this matters

Submitted content enters a third-party system. If the CLI, environment, or a dependency exposes the token, it could also be used to access or consume resources from the RunComfy account.

The documentation says the JSON request is submitted to RunComfy's Model API using the user's bearer token, so prompt content leaves the machine and the token is used as a remote authentication credential. The supplied material describes endpoints and local token storage but gives no server-side retention, training-use, or deletion policy. Impact depends on prompt sensitivity and RunComfy's external policies.

SKILL.md:46In the instructionsOpen original file
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
Show 2 other places
SKILL.md:178In the instructionsOpen original file
1. The skill invokes `runcomfy run happyhorse/happyhorse-1-0/text-to-video` with a JSON body matching the schema.2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/happyhorse/happyhorse-1-0/text-to-video` with the user's bearer token.3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 seconds.4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose host ends with `.runcomfy.net` or `.runcomfy.com` into `--output-dir`. Other URLs are listed but not fetched.
SKILL.md:191In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 1
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The installation example adds the Skill by repository name without a commit hash, tag, or version. Running it later could retrieve different repository content. The installed code is not included here, so this audit cannot bind the installation result to the displayed SKILL.md.

SKILL.md:25In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill happyhorse-1-0 -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Video generation may incur third-party GPU charges without a cost-confirmation step

Source references: 3
What we found

The Skill says it calls the remote model when an applicable generation request is made. Its cancellation note explicitly confirms that running GPU work is billable, but no price, budget limit, or pre-submission confirmation is provided.

Why this matters

On an account with a payment method or balance, single or repeated calls may create costs the user did not anticipate. The actual cost of longer, 1080p, or repeated iterations cannot be determined from the material.

The Skill says matching requests call a remote model, and the cancellation instruction explicitly refers to GPU billing, supporting a plausible account-charge risk. The shown workflow submits and polls the request without a visible price, budget cap, or pre-submission cost confirmation. Whether and how much is charged still depends on the RunComfy account and external pricing.

SKILL.md:10In the instructionsOpen original file
  schema, and when to route to Wan 2.7 / Seedance 2 / LTX 2 instead.  Calls `runcomfy run happyhorse/happyhorse-1-0/text-to-video` through  the local RunComfy CLI. Triggers on "happyhorse", "happy horse",  "happyhorse 1.0", "happyhorse video", or any explicit ask to generate  video with this model.homepage: https://www.runcomfy.com
Show 2 other places
SKILL.md:182In the instructionsOpen original file
4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose host ends with `.runcomfy.net` or `.runcomfy.com` into `--output-dir`. Other URLs are listed but not fetched.5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you stopped.
SKILL.md:178In the instructionsOpen original file
1. The skill invokes `runcomfy run happyhorse/happyhorse-1-0/text-to-video` with a JSON body matching the schema.2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/happyhorse/happyhorse-1-0/text-to-video` with the user's bearer token.3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 seconds.4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose host ends with `.runcomfy.net` or `.runcomfy.com` into `--output-dir`. Other URLs are listed but not fetched.

Inside this skill

8 instruction sections

The Skill uses the local RunComfy CLI to submit the user's prompt to the HappyHorse text-to-video endpoint and saves results in a user-selected directory.

View source
SKILL.md:178In the instructionsOpen original file
1. The skill invokes `runcomfy run happyhorse/happyhorse-1-0/text-to-video` with a JSON body matching the schema.2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/happyhorse/happyhorse-1-0/text-to-video` with the user's bearer token.3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 seconds.4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose host ends with `.runcomfy.net` or `.runcomfy.com` into `--output-dir`. Other URLs are listed but not fetched.5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you stopped.

Use requires a globally installed npm CLI and either browser login or a RunComfy token supplied through an environment variable.

View source
SKILL.md:44In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.

The CLI continuously polls the remote job and then downloads generated files from RunComfy domains; the documentation claims a 2 GiB limit per download.

View source
SKILL.md:92In the instructionsOpen original file
The CLI submits, polls every 2s until terminal, then downloads any `*.runcomfy.net` / `*.runcomfy.com` URL from the result into `--output-dir`. Stdout is the result JSON. Stderr is progress.
SKILL.md:195In the instructionsOpen original file
- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.
Start here · InstructionsSKILL.md
happyhorse-1-0
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 4 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:14In the instructionsOpen original file
  video with this model.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:20In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=happyhorse-1-0) · [Text-to-video](https://www.runcomfy.com/models/happyhorse/happyhorse-1-0/text-to-video?utm_source=skills.sh&utm_medium=skill&utm_campaign=happyhorse-1-0) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/happyhorse-1-0)
SKILL.md:174In the instructionsOpen original file
Full reference: [docs.runcomfy.com/cli/troubleshooting](https://docs.runcomfy.com/cli/troubleshooting?utm_source=skills.sh&utm_medium=skill&utm_campaign=happyhorse-1-0).
Run commands
SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill happyhorse-1-0 -g
SKILL.md:65In the instructionsOpen original file
```bashruncomfy run happyhorse/happyhorse-1-0/text-to-video \
SKILL.md:73In the instructionsOpen original file
```bashruncomfy run happyhorse/happyhorse-1-0/text-to-video \
Install extra software packages
SKILL.md:25In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill happyhorse-1-0 -g```
Lines read
196
File checksum (to compare versions)
3c839aee73c70ebddc949748911e41e52f55c68a92f851b092304d45a12a587c