Skip to content
skillsafebeta
← Report library
Purpose / Other

Image To Video Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Setup executes and globally installs third-party npm software with the user's privileges

Source references: 4
What we found

The documentation requires `npm i -g @runcomfy/cli`, and its Skill-install example uses `npx`. npm/npx packages can execute package scripts during installation or first use, while the supplied source contains no CLI implementation to inspect.

Why this matters

If the package, a dependency, or its publisher account is compromised, installation code could read or change files and credentials accessible to the user. A global install also leaves a persistently callable program.

The instructions require a global installation of `@runcomfy/cli`, and the skill-install example retrieves and runs a third-party package through `npx`. The supplied source contains only the skill document, not those packages' implementation or pinned versions, so their executed code cannot be verified here. If users follow these commands, the packages operate with the invoking user's permissions. Users can request pinned versions and inspect package/install scripts first.

SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-to-video -g```
Show 3 other places
SKILL.md:46In the instructionsOpen original file
## Prerequisites1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.4. **A source image URL** — JPEG/PNG/WebP, min 300px, ≤10MB; aspect 1:2.5 to 2.5:1 (HappyHorse) — other models have similar specs.
SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-to-video -g```
SKILL.md:48In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Portraits, voices, and reference media are disclosed to RunComfy's remote servers

Source references: 4
What we found

Image, video, and audio URLs are not processed solely on the local machine. The documentation says the server fetches them, while the CLI transmits prompts and job JSON to the model API.

Why this matters

If a URL exposes private, signed, or unreleased material, the third-party service can retrieve it. Faces, voices, products, and brand references may be sensitive or contract-restricted data.

When a task runs, its prompt and JSON body are submitted to RunComfy's Model API, while RunComfy's server fetches the supplied image, video, and audio URLs. Portraits, voices, brand media, and URL-accessible data therefore leave the local machine. Users should submit only media authorized for RunComfy and ask about retention, training use, and deletion policies.

SKILL.md:143In the instructionsOpen original file
|---|---|---|---|---|| `prompt` | string | yes | — | CN ≤500 chars OR EN ≤1000 words. || `image_url` | array | yes (for i2v) | `[]` | 0–9 images. **First is the primary subject.** || `video_url` | array | no | `[]` | 0–3 reference clips (MP4/MOV), 2–15s each. || `audio_url` | array | no | `[]` | 0–3 reference audio (WAV/MP3), 2–15s, < 15MB each. || `aspect_ratio` | enum | no | `adaptive` | `adaptive`, `16:9`, `9:16`, `4:3`, `3:4`, `1:1`, `21:9`. || `duration` | int | no | 5 | 4–15 (whole seconds). || `resolution` | enum | no | `720p` | `480p` or `720p`. || `generate_audio` | bool | no | true | In-pass synchronized speech / SFX / music. || `seed` | int | no | — | Reproducibility. |
Show 3 other places
SKILL.md:197In the instructionsOpen original file
The skill picks one of HappyHorse 1.0 I2V / Wan 2.7 t2v+audio / Seedance 2.0 Pro based on user intent and invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:203In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.
SKILL.md:159In the instructionsOpen original file
    "prompt": "Subject from image 1 walks through the café in video 1, voice tone matches audio 1. Medium close-up, slow push-in, warm light, gentle ambience.",    "image_url": ["https://.../subject.jpg"],    "video_url": ["https://.../cafe-locked-shot.mp4"],    "audio_url": ["https://.../voice-tone.mp3"],    "duration": 8  }' \
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Low risk

The install command does not pin a dependency version

Source references: 1
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The installation example selects a skill from a GitHub repository without a commit hash, tag, or version. Running it later could retrieve changed upstream content rather than the file reviewed here. A user can ask for a commit-pinned or versioned installation and inspect the retrieved content before installation.

SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-to-video -g```
Low risk

Login persists an account token in the user's home configuration

Source references: 3
What we found

Browser login writes the API token to `~/.config/runcomfy/token.json`. Mode 0600 blocks other ordinary local accounts, but processes running with the user's privileges can still read it.

Why this matters

On a shared, compromised, or overly broad-backed-up machine, a party that gains the user's privileges could copy the token and submit remote jobs as that account.

Interactive login persistently writes the API token under the user's home directory. The stated 0600 mode limits other ordinary accounts, but programs running as the same user may still read it, and compromise of that account could expose it. Users can prefer a task-scoped `RUNCOMFY_TOKEN` and ask the provider about token scope, lifetime, and revocation.

SKILL.md:48In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.4. **A source image URL** — JPEG/PNG/WebP, min 300px, ≤10MB; aspect 1:2.5 to 2.5:1 (HappyHorse) — other models have similar specs.
Show 2 other places
SKILL.md:201In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.
SKILL.md:49In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.4. **A source image URL** — JPEG/PNG/WebP, min 300px, ≤10MB; aspect 1:2.5 to 2.5:1 (HappyHorse) — other models have similar specs.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The “image plus custom voiceover” route does not send the source image to Wan

Source references: 5
What we found

The routing table assigns animation with custom-audio lip sync to Wan, but the documentation later identifies this as a text-to-video endpoint. Its invocation contains only a prompt and audio URL, with no `image_url`.

Why this matters

A user approving a “make this image speak” request may receive a newly generated person rather than an identity-preserving animation. This can waste model calls and mislead decisions involving spokespeople, brand characters, or identity consistency.

The routing table presents Wan as the choice to animate and lip-sync to custom audio, but the detailed section explicitly calls a text-to-video endpoint and describes a generated talking-head. Its example sends a prompt and `audio_url`, with no source-image field. A user expecting the original person's identity could therefore receive a newly generated person rather than an animated source image. Ask the author to correct the capability claim or verify actual source-image support before a paid run.

SKILL.md:38In the instructionsOpen original file
| Native synchronized ambient audio in one pass | **HappyHorse 1.0 I2V** | In-pass audio synthesis || Animate **and** lip-sync to a **custom voiceover track** | **Wan 2.7 + `audio_url`** | Accepts your own MP3/WAV (3–30s, ≤15MB) and drives lip-sync to it || Multi-language dub variants (same image, different audio per call) | **Wan 2.7 + `audio_url`** | Same shot, swap `audio_url` per language || Multi-modal — image + reference video + reference audio together | **Seedance 2.0 Pro** | Up to 9 image refs, 3 video refs (2–15s each), 3 audio refs |
Show 4 other places
SKILL.md:93In the instructionsOpen original file
## Route 2: Wan 2.7 + `audio_url` — when the user has a custom voiceover**Model**: `wan-ai/wan-2-7/text-to-video` (NOT `/image-to-video` — Wan 2.7's t2v endpoint accepts an `audio_url` that drives lip-sync)**Note on i2v with Wan 2.7**: Wan 2.7's primary i2v animation isn't on a dedicated endpoint here. For pure i2v (image animated by motion prompt only), prefer **HappyHorse i2v**. Use Wan 2.7 specifically when the user has a custom audio track they want lip-synced to a generated talking-head clip.
SKILL.md:113In the instructionsOpen original file
```bashruncomfy run wan-ai/wan-2-7/text-to-video \  --input '{    "prompt": "Medium close-up of a confident spokesperson in a softly-lit recording booth, leaning slightly toward the camera, locked tripod, shallow DOF, warm key light from camera-left.",    "audio_url": "https://.../voiceover-en.mp3",    "duration": 12,    "aspect_ratio": "9:16"  }' \  --output-dir <absolute/path>```
SKILL.md:95In the instructionsOpen original file
**Model**: `wan-ai/wan-2-7/text-to-video` (NOT `/image-to-video` — Wan 2.7's t2v endpoint accepts an `audio_url` that drives lip-sync)**Note on i2v with Wan 2.7**: Wan 2.7's primary i2v animation isn't on a dedicated endpoint here. For pure i2v (image animated by motion prompt only), prefer **HappyHorse i2v**. Use Wan 2.7 specifically when the user has a custom audio track they want lip-synced to a generated talking-head clip.
SKILL.md:114In the instructionsOpen original file
```bashruncomfy run wan-ai/wan-2-7/text-to-video \  --input '{    "prompt": "Medium close-up of a confident spokesperson in a softly-lit recording booth, leaning slightly toward the camera, locked tripod, shallow DOF, warm key light from camera-left.",    "audio_url": "https://.../voiceover-en.mp3",    "duration": 12,    "aspect_ratio": "9:16"  }' \  --output-dir <absolute/path>

Inside this skill

8 instruction sections

The Skill is a model-routing instruction set: it selects HappyHorse, Wan 2.7, or Seedance based on intent, then has the local RunComfy CLI submit work to a remote model API, poll it, and download generated files.

View source
SKILL.md:195In the instructionsOpen original file
## How it worksThe skill picks one of HappyHorse 1.0 I2V / Wan 2.7 t2v+audio / Seedance 2.0 Pro based on user intent and invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.

The default route sends an image URL and motion prompt to HappyHorse; custom voiceover switches to Wan's text-to-video endpoint; combined image, video, and audio references are routed to Seedance.

View source
SKILL.md:35In the instructionsOpen original file
|---|---|---|| Animate a portrait — keep identity stable | **HappyHorse 1.0 I2V** | #1 on Artificial Analysis Arena (Elo 1392); strong facial fidelity || Product reveal / 360 / macro motion | **HappyHorse 1.0 I2V** | Geometry preservation + smooth camera moves || Native synchronized ambient audio in one pass | **HappyHorse 1.0 I2V** | In-pass audio synthesis || Animate **and** lip-sync to a **custom voiceover track** | **Wan 2.7 + `audio_url`** | Accepts your own MP3/WAV (3–30s, ≤15MB) and drives lip-sync to it || Multi-language dub variants (same image, different audio per call) | **Wan 2.7 + `audio_url`** | Same shot, swap `audio_url` per language || Multi-modal — image + reference video + reference audio together | **Seedance 2.0 Pro** | Up to 9 image refs, 3 video refs (2–15s each), 3 audio refs || Brand-consistent narrative with character ref + scene ref + voice ref | **Seedance 2.0 Pro** | Image holds identity, video holds scene, audio holds voice || Default if unspecified | **HappyHorse 1.0 I2V** | Best all-round quality + native audio |

Use requires installing a third-party global CLI and authenticating through a browser or environment token; browser login persists the token in the user's configuration directory.

View source
SKILL.md:46In the instructionsOpen original file
## Prerequisites1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.4. **A source image URL** — JPEG/PNG/WebP, min 300px, ≤10MB; aspect 1:2.5 to 2.5:1 (HappyHorse) — other models have similar specs.
SKILL.md:199In the instructionsOpen original file
## Security & Privacy- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.

Outputs are written to a caller-selected absolute directory; the documentation says the CLI aborts an individual download above 2 GiB.

View source
SKILL.md:74In the instructionsOpen original file
```bashruncomfy run happyhorse/happyhorse-1-0/image-to-video \  --input '{    "image_url": "https://.../portrait.jpg",    "prompt": "Gentle camera drift around the subject'\''s face, subtle breathing motion, identity-stable features, soft natural light."  }' \  --output-dir <absolute/path>```
SKILL.md:203In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.
Start here · InstructionsSKILL.md
image-to-video
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 1 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:17In the instructionsOpen original file
  this move", or any explicit ask to turn a still into video.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:23In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-to-video) · [HappyHorse I2V](https://www.runcomfy.com/models/happyhorse/happyhorse-1-0/image-to-video?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-to-video) · [Wan 2.7](https://www.runcomfy.com/models/wan-ai/wan-2-7/text-to-video?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-to-video) · [Seedance 2.0 Pro](https://www.runcomfy.com/models/bytedance/seedance-v2/pro?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-to-video) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/image-to-video)
SKILL.md:77In the instructionsOpen original file
  --input '{    "image_url": "https://.../portrait.jpg",    "prompt": "Gentle camera drift around the subject'\''s face, subtle breathing motion, identity-stable features, soft natural light."
Run commands
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-to-video -g
SKILL.md:74In the instructionsOpen original file
```bashruncomfy run happyhorse/happyhorse-1-0/image-to-video \
SKILL.md:113In the instructionsOpen original file
```bashruncomfy run wan-ai/wan-2-7/text-to-video \
Install extra software packages
SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-to-video -g```
Lines read
206
File checksum (to compare versions)
a8f617611ed267cf21683e39c76b9514ec0f12e2f3e02e5f916c143bf8c3aa1b