ai-video-generation
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
@runcomfy/clipackage from npm. This is a scoped package belonging to the vendor's own infrastructure. - [COMMAND_EXECUTION]: The agent uses the
runcomfyCLI to perform video generation. Commands utilize the--inputflag with structured JSON to pass parameters, effectively neutralizing shell injection risks from user-supplied prompt text. - [CREDENTIALS_UNSAFE]: Secret management follows best practices. The skill instructs on the use of the
RUNCOMFY_TOKENenvironment variable or a local config file with restricted permissions (0600). It explicitly warns against echoing or logging the API token. - [PROMPT_INJECTION]: The skill identifies an indirect prompt injection surface where third-party media (images/audio/video) could contain instructions intended to steer the model. It provides clear mitigation strategies, such as instructing the agent to only ingest user-provided URLs and prioritize the system prompt over asset content.
Audit Metadata