wan-2-7
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
runcomfycommand-line interface to execute video generation tasks on the RunComfy Model API. - [EXTERNAL_DOWNLOADS]: The skill documentation instructs the installation of the
@runcomfy/clipackage from the npm registry to enable its core functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data, creating a potential surface for indirect prompt injection via user-supplied prompts or remote audio files.
- Ingestion points: The skill accepts user-defined
promptstrings and remoteaudio_urllinks (SKILL.md). - Boundary markers: Input data is encapsulated within a JSON object before being passed to the CLI.
- Capability inventory: The skill utilizes the
runcomfyCLI to perform network operations and local file downloads (SKILL.md). - Sanitization: The skill documentation notes that the CLI transmits JSON bodies directly to the API via HTTPS and avoids shell expansion of prompt content.
Audit Metadata