image-to-video

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The GitHub repo is a third‑party code source (used by an npx install) and several example URLs are opaque/placeholder direct media links (https://.../...) which obscure their true hosts — these are potential vectors for malicious code or content delivery, while the visible runcomfy/docs links are official.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests outsider-authored free text via the user-provided prompt (and negative_prompt) fields passed through runcomfy run <model_id> --input, which the Model API consumes to generate video.