happyhorse-1-0
Fail
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill directs users to execute
npx skills add agentspace-so/runcomfy-skills, which downloads and runs code from a GitHub repository that is not included in the trusted vendor list. - [COMMAND_EXECUTION]: The documentation requires the global installation of an unverified NPM package (
npm i -g @runcomfy/cli) and the subsequent execution of theruncomfyCLI tool. Executing binaries from non-trusted sources poses a risk of system compromise. - [CREDENTIALS_UNSAFE]: The skill explicitly states that the
runcomfy loginprocess stores sensitive API tokens in a plain-text configuration file located at~/.config/runcomfy/token.json. Storing credentials in a predictable local path increases the risk of data theft by other malicious processes. - [EXTERNAL_DOWNLOADS]: The skill automatically downloads generated video files from remote domains (
*.runcomfy.netand*.runcomfy.com) based on model output. While the skill claims to have a size limit, fetching external content based on remote instructions introduces an attack surface for data-driven exploits.
Recommendations
- AI detected serious security threats
Audit Metadata