media-svd

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Two of the links (127.0.0.1:8188 and huggingface.co) are standard/local/official and low risk, but the GitHub repo is a third‑party ComfyUI custom-node (unvetted code you would clone/run locally) and therefore potentially suspicious — review its source and avoid running untrusted code or installers.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The animate subcommand posts your workflow JSON to a ComfyUI server URL (POST to {server}/prompt and then GET {server}/view), so supplying a remote server (e.g. http://host:8188) causes that external URL to execute the workflow you send (default shown as http://127.0.0.1:8188 in the docs).