happyhorse-1-0
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
runcomfyCLI tool to execute model runs. These commands are well-documented, specific to the vendor's platform, and include security measures like using JSON input to prevent shell injection. - [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@runcomfy/clifrom the official NPM registry and fetches model outputs from the vendor's own domains (*.runcomfy.netand*.runcomfy.com). These are standard operations for the skill's purpose and originate from the vendor's infrastructure. - [CREDENTIALS_UNSAFE]: The skill correctly advises users to manage sensitive API tokens using environment variables (
RUNCOMFY_TOKEN) or a configuration file with restricted permissions (0600), which is a recommended security practice for CLI tools. - [INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risk of prompt injection when processing external content (like URLs) but emphasizes that the CLI performs downloads from a strict whitelist and that the model itself handles the processing on a remote server.
Audit Metadata