Skip to content
skillsafebeta
← Report library
Purpose / Other

Seedance V2 Skill Security Audit

What the author says it does (original text)

>

Independent security check

Do not install or run it yet

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The prerequisite globally installs and runs a third-party npm CLI

Source references: 2
What we found

The instructions require `npm i -g @runcomfy/cli` and also show an `npx` command that globally adds the Skill. npm installation can execute package lifecycle scripts with the current user's permissions and persistently alter the global tool environment. The package implementation is absent, so its behavior cannot be verified in this audit.

Why this matters

If the package, a dependency, or its publisher account is compromised, installation could read user-accessible files, change configuration, or execute other commands. A global install also affects the CLI version used later by that account.

The prerequisites globally install a third-party CLI, and the Skill installation example also uses the global `-g` option. npm installation can run package lifecycle scripts with the user's privileges and persistently alter the tool environment, although the package implementations are absent here, so malicious behavior cannot be asserted. Users can request pinned versions, a lifecycle-script inventory, and an independent audit, or install in isolation.

SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill seedance-v2 -g```
Show 1 other places
SKILL.md:46In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
High risk

Prompts and identity-reference media are disclosed to the third-party RunComfy service

Source references: 3
What we found

The CLI sends prompts to the RunComfy API, and its model server fetches supplied image, video, and audio URLs. Faces, voices, unreleased material, or credential-bearing URLs therefore leave the user's controlled environment. The supplied material gives no retention, training-use, access, or deletion policy.

Why this matters

RunComfy and its processing chain may gain access to personal data, customer material, trade secrets, or signed-URL query tokens contained in the request.

Generation sends the prompt to RunComfy's API, and its model server fetches supplied image, video, and audio URLs. Faces, voices, private media, and access parameters embedded in URLs therefore reach a third party. The provided material does not state retention, training, or deletion rules; users can limit inputs to authorized material and ask the provider for those policies.

SKILL.md:57In the instructionsOpen original file
| `prompt` | string | yes | — | CN ≤ 500 chars OR EN ≤ 1000 words. || `image_url` | array | no | `[]` | 0–9 references (JPEG/PNG/WebP/BMP/TIFF/GIF). || `video_url` | array | no | `[]` | 0–3 clips (MP4/MOV), 2–15s each. || `audio_url` | array | no | `[]` | 0–3 audio refs (WAV/MP3), 2–15s, < 15MB each. || `aspect_ratio` | enum | no | `adaptive` | `adaptive`, `16:9`, `9:16`, `4:3`, `3:4`, `1:1`, `21:9`. |
Show 2 other places
SKILL.md:173In the instructionsOpen original file
The skill invokes `runcomfy run bytedance/seedance-v2/pro` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/bytedance/seedance-v2/pro`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:179In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Remote generated results can write very large files into a local output directory

Source references: 2
What we found

The CLI automatically downloads remote results into `--output-dir`. The documentation promises only a 2 GiB limit per individual file and states no cumulative download limit per job.

Why this matters

One or more large outputs may consume substantial disk space, causing the job or other applications and file operations on the same disk to fail.

The CLI automatically downloads remote results into a user-selected directory. The documented safeguard stops only a single download over 2 GiB and gives no per-job aggregate limit, so multiple large outputs could still consume substantial disk space. Users can choose a dedicated quota-limited directory with sufficient free space and ask the provider for file-count and total-size limits.

SKILL.md:102In the instructionsOpen original file
The CLI submits, polls, fetches the result, downloads `*.runcomfy.net`/`*.runcomfy.com` URLs into `--output-dir`.
Show 1 other places
SKILL.md:181In the instructionsOpen original file
- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The installation example uses `npx` to add the Skill from a repository without pinning a release or commit, so the same command may retrieve changed content later. The user can ask for an audited version or commit hash and verify the source before installation.

SKILL.md:25In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill seedance-v2 -g```
Show 1 other places
SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill seedance-v2 -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

External reference media may influence output through visual prompt injection

Source references: 2
What we found

The Skill allows the model server to fetch third-party media URLs and explicitly acknowledges image-based prompt injection as a known risk. Malicious or replaced reference media may contain visual instructions the model follows without the user's intended authorization.

Why this matters

A generated video could deviate from the user's prompt or include misleading, offensive, or unauthorized text, branding, or behavior. Publishing it without review could affect reputation or business decisions.

The documentation explicitly allows a third-party server to fetch external reference media and identifies image-based prompt injection as a known risk. If media is untrusted or later replaced, hidden content may influence the model's output; the evidence does not show that it can execute local commands. Users can restrict inputs to reviewed, immutable media they control and inspect outputs before use.

SKILL.md:179In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.
Show 1 other places
SKILL.md:95In the instructionsOpen original file
    "prompt": "Subject from image 1 walks through the café from video 1, voice tone matches audio 1.",    "image_url": ["https://.../subject.jpg"],    "video_url": ["https://.../cafe-locked-shot.mp4"],    "audio_url": ["https://.../voice-ref.mp3"]  }' \
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill uses the local RunComfy CLI to submit a JSON request to RunComfy's Seedance 2.0 Pro endpoint, poll for completion, and download generated files into a user-selected directory.

View source
SKILL.md:173In the instructionsOpen original file
The skill invokes `runcomfy run bytedance/seedance-v2/pro` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/bytedance/seedance-v2/pro`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.

A request may include up to nine images, three videos, and three audio references. RunComfy's model server, rather than the local CLI, fetches referenced media.

View source
SKILL.md:57In the instructionsOpen original file
| `prompt` | string | yes | — | CN ≤ 500 chars OR EN ≤ 1000 words. || `image_url` | array | no | `[]` | 0–9 references (JPEG/PNG/WebP/BMP/TIFF/GIF). || `video_url` | array | no | `[]` | 0–3 clips (MP4/MOV), 2–15s each. || `audio_url` | array | no | `[]` | 0–3 audio refs (WAV/MP3), 2–15s, < 15MB each. || `aspect_ratio` | enum | no | `adaptive` | `adaptive`, `16:9`, `9:16`, `4:3`, `3:4`, `1:1`, `21:9`. |
SKILL.md:179In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.

Use requires a globally installed npm CLI and RunComfy authentication. Login stores a token in the user's configuration directory, while CI may provide it through an environment variable.

View source
SKILL.md:46In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
SKILL.md:177In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.

Generated results are written to the selected directory. The CLI claims a 2 GiB per-file limit, but the supplied material does not state a limit on the number of files or total bytes per job.

View source
SKILL.md:102In the instructionsOpen original file
The CLI submits, polls, fetches the result, downloads `*.runcomfy.net`/`*.runcomfy.com` URLs into `--output-dir`.
SKILL.md:181In the instructionsOpen original file
- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.
Start here · InstructionsSKILL.md
seedance-v2
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:14In the instructionsOpen original file
  video with this model.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:20In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=seedance-v2) · [Seedance 2.0 Pro](https://www.runcomfy.com/models/bytedance/seedance-v2/pro?utm_source=skills.sh&utm_medium=skill&utm_campaign=seedance-v2) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/seedance-v2)
SKILL.md:82In the instructionsOpen original file
    "prompt": "Medium close-up. The woman explains today'\''s special in a warm friendly tone, slow push-in, soft window light, gentle cafe ambience.",    "image_url": ["https://.../barista-headshot.jpg"],    "duration": 8,
Run commands
SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill seedance-v2 -g
SKILL.md:70In the instructionsOpen original file
```bashruncomfy run bytedance/seedance-v2/pro \
SKILL.md:78In the instructionsOpen original file
```bashruncomfy run bytedance/seedance-v2/pro \
Install extra software packages
SKILL.md:25In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill seedance-v2 -g```
Lines read
182
File checksum (to compare versions)
a3993946ba53c571aa99589919e5012f9ab17099bf63ca82373ee45d374ac28c