video-extend
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external video content provided via a URL, which represents a surface for indirect instructions to be passed to the model (e.g., via text in frames or metadata). * Ingestion points: The
video_urlinput parameter in theruncomfy runcommand located inSKILL.md. * Boundary markers: Input is passed as a structured JSON string to the CLI to prevent shell injection, as documented in the security section. * Capability inventory: The skill uses theBash(runcomfy *)tool to execute video processing commands and write outputs to the local filesystem (./out). * Sanitization: The skill advises agents to only use user-provided URLs and provides guidance on detecting model divergence caused by untrusted input. - [COMMAND_EXECUTION]: The skill invokes the
runcomfyCLI via bash to perform video extension tasks, login, and installation. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@runcomfy/clipackage from the public npm registry, which is the official tool provided by the skill author.
Audit Metadata