runway-image
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill follows security best practices by instructing users to store API secrets in environment variables (
RUNWAYML_API_SECRET) rather than hardcoding them within the scripts or prompts. - [EXTERNAL_DOWNLOADS]: Downloads are restricted to official Runway endpoints and user-defined allowlisted hosts. The provided implementation includes validation for HTTPS, public IP addresses, MIME types, file signatures, and maximum pixel dimensions to mitigate risks associated with untrusted remote content.
- [DATA_EXFILTRATION]: Network activity is transparent and limited to the official Runway API and specified output destinations. There is no evidence of unauthorized data collection or transmission to third-party servers.
- [COMMAND_EXECUTION]: The provided code examples use standard library functions for file system operations (creating directories, writing artifacts) and network requests, without spawning arbitrary sub-processes or executing unverified shell commands.
Audit Metadata