video-inpainting
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the @runcomfy/cli package from the public NPM registry. This package is the primary interface for the RunComfy service.
- [COMMAND_EXECUTION]: Tasks are executed using the runcomfy command within a Bash tool. The instructions emphasize passing inputs as JSON strings to avoid shell injection vulnerabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risk of processing untrusted external video URLs. It provides specific instructions for the agent to limit ingestion to user-specified sources and to monitor for unexpected model behavior indicative of malicious instructions embedded in media files.
Audit Metadata