Skip to content
skillsafebeta
← Report library
Purpose / Other

Lipsync Skill Security Audit

What the author says it does (original text)

>

Independent security check

Do not install or run it yet

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installation downloads and executes a third-party npm package

Source references: 2
What we found

The Skill instructs the user to install `@runcomfy/cli` globally or have `npx -y` automatically download and execute it. A global installation persistently changes the user's tool environment, and both methods run code shipped in the package.

Why this matters

If the package, a dependency, or its publisher account is compromised, installation or execution could access files, environment variables, and credentials available to the current user. A global install may also change an existing CLI version.

This is an actionable installation and sign-in workflow, not merely a warning. `npm i -g` persistently installs a third-party CLI, while `npx -y` automatically obtains and runs it; the CLI can then access the RunComfy login token. The source limits installation to a package manager and rejects piped remote scripts, which mitigates one risk but does not verify the npm package itself. Users can require a pinned, reviewed version or run it in an isolated environment.

SKILL.md:30In the instructionsOpen original file
```bash# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version# 2. Sign inruncomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>
Show 1 other places
SKILL.md:219In the instructionsOpen original file
- **Consent**: see the "Consent" section above. Lipsync is dual-use; refuse user requests targeting real people without consent.- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var in CI / containers.- **Input boundary (shell injection)**: prompts and asset URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content. **No shell-injection surface**.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
High risk

Face, video, and voice assets are processed by a remote model service

Source references: 3
What we found

The commands place portrait, source-video, and audio URLs in the job JSON, after which the CLI posts the job to RunComfy's Model API. Even when only URLs are submitted, the remote service must access the assets to produce the result.

Why this matters

The assets may contain biometric data, voices, unreleased footage, or private URLs carrying access credentials. Remote processing exposes these assets and URLs to RunComfy's processing chain and potentially to its retention, logging, and downstream-model-provider policies.

The active workflow submits user-provided video, audio, or portrait URLs to the RunComfy Model API, then downloads the generated result. When invoked, the remote service must access and process those assets, potentially exposing face, voice, and video data. A user can ask about retention, secondary use, and processing location, and restrict inputs to authorized assets served through revocable URLs.

SKILL.md:111In the instructionsOpen original file
```bashruncomfy run sync/sync/lipsync/v2/pro \  --input '{    "video_url": "https://your-cdn.example/source-video.mp4",    "audio_url": "https://your-cdn.example/voiceover.mp3"  }' \  --output-dir ./out```
Show 2 other places
SKILL.md:136In the instructionsOpen original file
```bashruncomfy run bytedance/omnihuman/api \  --input '{    "image_url": "https://your-cdn.example/portrait.jpg",    "audio_url": "https://your-cdn.example/voiceover.mp3"  }' \  --output-dir ./out```
SKILL.md:214In the instructionsOpen original file
The skill classifies user intent — source video + audio? portrait still + audio? script only? — picks the matching route, and invokes `runcomfy run` with the JSON body. The CLI POSTs to the Model API, polls request status, fetches the result, and downloads any `.runcomfy.net` / `.runcomfy.com` URLs into `--output-dir`.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Consent restrictions rely entirely on the operator and do not block impersonation

Source references: 5
What we found

The Skill explicitly says it does not gate inputs and leaves responsibility to the operator. It can turn one portrait and audio into a speaking video and can repeat this for multiple languages with the same identity.

Why this matters

If the operator skips the checks, the system can produce footage that appears to show a real person saying something they never said, enabling impersonation, defamation, fraud, or unauthorized advertising. Separate consent for the face and voice is not technically enforced.

The documentation instructs the operator to reject requests involving real people without consent, but explicitly states that the Skill itself does not gate inputs. Enforcement therefore depends on the agent or operator. The workflow can animate one portrait from audio and repeat that identity across multiple languages, creating an impersonation risk if consent checks are skipped. Users can require documented authorization for both likeness and voice before every run and restrict batch generation.

SKILL.md:47In the instructionsOpen original file
Driving a real person's mouth from a separate audio track is dual-use. Refuse user requests that target real public figures without consent, or that aim at defamatory or sexually explicit synthetic media. The skill itself does not gate inputs — the responsibility rests with the operator.
Show 4 other places
SKILL.md:79In the instructionsOpen original file
**OmniHuman** — `bytedance/omnihuman/api` *(default for avatar-style)*> ByteDance's audio-driven full-body avatar. One portrait + one audio → video where the subject speaks / gestures naturally. Listed under RunComfy's `/feature/lip-sync` as the curated default.> Pick for: UGC voiceover, virtual presenter, dubbed product demo from a single portrait.> Avoid for: lip-sync onto an existing **video** (no portrait, want to preserve original motion) — use **Sync Labs v2** instead.
SKILL.md:180In the instructionsOpen original file
### Multi-language launch (same identity, many languages)- **Route 2 (OmniHuman)** with one portrait + N different audio files. Same identity holds across all dubs.
SKILL.md:225In the instructionsOpen original file
  - When the output diverges from the prompt (wrong identity, broken sync), suspect the reference asset.- **Voice provenance**: confirm the speaker in the audio has consented to having their voice paired with the target face. Both rights must be in hand.- **Outbound endpoints (allowlist)**: only `model-api.runcomfy.net` and `*.runcomfy.net` / `*.runcomfy.com`. No telemetry.
SKILL.md:136In the instructionsOpen original file
```bashruncomfy run bytedance/omnihuman/api \  --input '{    "image_url": "https://your-cdn.example/portrait.jpg",    "audio_url": "https://your-cdn.example/voiceover.mp3"  }' \  --output-dir ./out```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Defaulting to a premium model may incur account charges without price confirmation

Source references: 3
What we found

The Skill designates Sync Labs v2 Pro as the default for premium work and says the standard tier is preferable for cost-sensitive jobs, but it does not require showing a price or obtaining spending confirmation before submitting the remote job.

Why this matters

If the RunComfy account is billed per call, duration, or generation, automatic Pro routing may consume credits or cost more than expected, especially for batch work.

The documentation makes Pro the premium default and directs cost-sensitive jobs to the standard tier, establishing a meaningful cost difference, while the shown invocation has no price-confirmation step. If an agent submits the default Pro job directly, the user could consume a more expensive service without seeing its price first. The supplied source does not state actual rates or billing mechanics; users can require the model, estimated charge, and job count to be shown and approved before submission.

SKILL.md:57In the instructionsOpen original file
**Sync Labs sync v2 Pro** — `sync/sync/lipsync/v2/pro` *(default for premium)*> Sync Labs' premium lip-sync — state-of-the-art mouth motion onto an existing video. Preserves the rest of the frame untouched.> Pick for: hero-quality dubs, lipsync on professionally-shot video, foreign-language dubbing where mouth fidelity matters most.> Avoid for: cost-sensitive batch jobs — drop to **sync v2**.
Show 2 other places
SKILL.md:111In the instructionsOpen original file
```bashruncomfy run sync/sync/lipsync/v2/pro \  --input '{    "video_url": "https://your-cdn.example/source-video.mp4",    "audio_url": "https://your-cdn.example/voiceover.mp3"  }' \  --output-dir ./out```
SKILL.md:108In the instructionsOpen original file
### Invoke```bashruncomfy run sync/sync/lipsync/v2/pro \  --input '{    "video_url": "https://your-cdn.example/source-video.mp4",    "audio_url": "https://your-cdn.example/voiceover.mp3"  }' \  --output-dir ./out```

Inside this skill

8 instruction sections

The Skill routes among several RunComfy models based on whether the input is video plus audio, portrait plus audio, or script only. It then calls `runcomfy run`; the CLI submits the job to a remote model API, polls it, and downloads the result.

View source
SKILL.md:53In the instructionsOpen original file
Listed newest first within each subtype. The agent picks one route based on: input shape (portrait still + audio vs source video + audio vs script-only), quality tier, and budget.
SKILL.md:214In the instructionsOpen original file
The skill classifies user intent — source video + audio? portrait still + audio? script only? — picks the matching route, and invokes `runcomfy run` with the JSON body. The CLI POSTs to the Model API, polls request status, fetches the result, and downloads any `.runcomfy.net` / `.runcomfy.com` URLs into `--output-dir`.

The Skill requires signing in to a RunComfy account. The token is stored in the user's configuration directory, or may be supplied through an environment variable in CI.

View source
SKILL.md:34In the instructionsOpen original file
# 2. Sign inruncomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>
SKILL.md:220In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var in CI / containers.- **Input boundary (shell injection)**: prompts and asset URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content. **No shell-injection surface**.

The Skill recognizes that lip-sync is dual-use and directs the operator to reject non-consensual targeting of real people and defamatory or sexually explicit synthetic media. There is no technical input gate, so enforcement depends on the operator.

View source
SKILL.md:47In the instructionsOpen original file
Driving a real person's mouth from a separate audio track is dual-use. Refuse user requests that target real public figures without consent, or that aim at defamatory or sexually explicit synthetic media. The skill itself does not gate inputs — the responsibility rests with the operator.
SKILL.md:218In the instructionsOpen original file
- **Consent**: see the "Consent" section above. Lipsync is dual-use; refuse user requests targeting real people without consent.- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.
SKILL.md:225In the instructionsOpen original file
  - When the output diverges from the prompt (wrong identity, broken sync), suspect the reference asset.- **Voice provenance**: confirm the speaker in the audio has consented to having their voice paired with the target face. Both rights must be in hand.- **Outbound endpoints (allowlist)**: only `model-api.runcomfy.net` and `*.runcomfy.net` / `*.runcomfy.com`. No telemetry.
Start here · InstructionsSKILL.md
lipsync
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 4 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:3In the instructionsOpen original file
name: lipsyncallowed-tools: Bash(runcomfy *)displayName: "Lipsync"
SKILL.md:30In the instructionsOpen original file
```bash# 1. Install (see runcomfy-cli skill for details)
SKILL.md:110In the instructionsOpen original file
```bashruncomfy run sync/sync/lipsync/v2/pro \
Connect to websites
SKILL.md:18In the instructionsOpen original file
  an audio track.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:26In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=lipsync) · [Sync Labs models](https://www.runcomfy.com/models/sync/sync/lipsync/v2?utm_source=skills.sh&utm_medium=skill&utm_campaign=lipsync) · [CLI docs](https://docs.runcomfy.com/cli/introduction?utm_source=skills.sh&utm_medium=skill&utm_campaign=lipsync)
SKILL.md:43In the instructionsOpen original file
CLI deep dive: [`runcomfy-cli`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/runcomfy-cli) skill.
Install extra software packages
SKILL.md:32In the instructionsOpen original file
# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version
SKILL.md:219In the instructionsOpen original file
- **Consent**: see the "Consent" section above. Lipsync is dual-use; refuse user requests targeting real people without consent.- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var in CI / containers.
Lines read
237
File checksum (to compare versions)
a97859611002e29ca0549378c987d20d4370cafbef9d8ba937ceb926e8b421f4