Skip to content
skillsafebeta
← Report library
Purpose / Other

Wan 2 7 Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installation executes third-party npm software and makes a global machine-level change

Source references: 3
What we found

The instructions require a global npm installation of @runcomfy/cli and also show an npx command that adds the Skill from a remote repository. npm/npx packages can execute publisher-provided code during installation or launch, and the global installation leaves an executable in the user's global npm environment.

Why this matters

If the resolved package version or a dependency is compromised, third-party code could read accessible files and credentials or alter the local environment with the user's permissions. The shown commands pin no package version, commit, or integrity value.

The documentation gives two installation commands that obtain and run third-party npm content, including a global CLI installation that adds software to the user’s global npm environment. The source does not specify a pinned version, integrity check, or install-script restrictions. Users can isolate installation and ask for pinned versions, checksums, and required-permission details.

SKILL.md:23In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill wan-2-7 -g```
Show 2 other places
SKILL.md:43In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill wan-2-7 -g```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Prompts and audio references are disclosed to the third-party RunComfy service

Source references: 3
What we found

The CLI sends the complete JSON request to RunComfy's model API. When audio_url is supplied, RunComfy's server also fetches the referenced audio. Prompts may contain unpublished scripts, customer details, or brand material, while an audio URL may embed access tokens or other sensitive query parameters.

Why this matters

RunComfy receives the submitted text, parameters, and accessible audio content. A signed or token-bearing URL may also grant the service additional file access. The supplied source does not state RunComfy's retention, training-use, or deletion policy.

The invocation sends JSON containing the prompt and optional audio_url to RunComfy’s third-party API, where the audio is used for lip-sync. Thus the prompt and audio accessed for processing leave the local machine. Users should avoid confidential prompts, use narrowly scoped audio URLs without durable secrets, and ask about retention, logging, and deletion policies.

SKILL.md:54In the instructionsOpen original file
| `prompt` | string | yes | — | Up to ~5000 chars / ~1500 tokens. || `audio_url` | string | no | — | WAV/MP3, 3–30s, ≤15MB. **Drives lip-sync.** Omit → background music auto-generated. || `aspect_ratio` | enum | no | `16:9` | `16:9`, `9:16`, `1:1`, `4:3`, `3:4`. |
Show 2 other places
SKILL.md:177In the instructionsOpen original file
The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/wan-ai/wan-2-7/text-to-video`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:183In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 1
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The installation example references a repository without pinning a release or commit. Running the same command later could install Skill content different from what was reviewed. A user can ask for a versioned release or immutable commit hash and verify the source before installation.

SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill wan-2-7 -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Low risk

Default prompt expansion can alter tightly controlled copy or generation intent

Source references: 2
What we found

enable_prompt_expansion defaults to true, and the documentation says short prompts are automatically rewritten. The effective instruction sent through generation may therefore no longer be verbatim user input.

Why this matters

Brand copy, legal wording, product claims, or other text requiring exact approval may be added to, removed from, or reinterpreted, producing a video that does not match the approved material.

Prompt expansion is enabled by default and short prompts are automatically rewritten, so generation may be based on text that differs from the user’s wording. This matters for brand language, regulated copy, or other literal requirements. The documentation discloses the behavior and provides an opt-out; users can require enable_prompt_expansion: false and confirm the final request for strict tasks.

SKILL.md:59In the instructionsOpen original file
| `negative_prompt` | string | no | — | Up to 500 chars. Concrete issues to avoid. || `enable_prompt_expansion` | bool | no | true | Auto-rewrites short prompts. Disable for literal control. || `seed` | int | no | — | 0..2^31-1. Reuse for variants. |
Show 1 other places
SKILL.md:105In the instructionsOpen original file
**Prompt expansion is on by default.** Short prompts get auto-rewritten by the model. For terse / literal prompts (e.g. brand-strict ad copy), disable with `enable_prompt_expansion: false`.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill uses the local RunComfy CLI to submit a JSON request to RunComfy's model API, poll the job, and download generated results into a user-selected directory.

View source
SKILL.md:177In the instructionsOpen original file
The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/wan-ai/wan-2-7/text-to-video`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.

Use requires a globally installed npm CLI and either browser login or an API token in an environment variable; browser login stores the token in the user's configuration directory.

View source
SKILL.md:43In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
SKILL.md:181In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.

Prompt expansion is enabled by default, so short prompts may be automatically rewritten before generation; it can be explicitly disabled when literal control is required.

View source
SKILL.md:59In the instructionsOpen original file
| `negative_prompt` | string | no | — | Up to 500 chars. Concrete issues to avoid. || `enable_prompt_expansion` | bool | no | true | Auto-rewrites short prompts. Disable for literal control. || `seed` | int | no | — | 0..2^31-1. Reuse for variants. |
SKILL.md:105In the instructionsOpen original file
**Prompt expansion is on by default.** Short prompts get auto-rewritten by the model. For terse / literal prompts (e.g. brand-strict ad copy), disable with `enable_prompt_expansion: false`.
Start here · InstructionsSKILL.md
wan-2-7
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:13In the instructionsOpen original file
  "wan video", or any explicit ask to generate video with this model.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:19In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=wan-2-7) · [Text-to-video](https://www.runcomfy.com/models/wan-ai/wan-2-7/text-to-video?utm_source=skills.sh&utm_medium=skill&utm_campaign=wan-2-7) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/wan-2-7)
SKILL.md:78In the instructionsOpen original file
    "prompt": "Medium close-up of the spokesperson, warm key light, locked tripod, slight breathing motion.",    "audio_url": "https://.../voiceover.mp3",    "duration": 12,
Run commands
SKILL.md:23In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill wan-2-7 -g
SKILL.md:66In the instructionsOpen original file
```bashruncomfy run wan-ai/wan-2-7/text-to-video \
SKILL.md:74In the instructionsOpen original file
```bashruncomfy run wan-ai/wan-2-7/text-to-video \
Install extra software packages
SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill wan-2-7 -g```
Lines read
186
File checksum (to compare versions)
b5ee6fc70446df2e30d2f37590e43760a090845975f848ee2f05a0bb0848b4da