video-edit

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the runcomfy command-line interface to execute video generation and editing tasks on remote models (Wan 2.7, Kling 2.6, Lucy Edit).
  • [EXTERNAL_DOWNLOADS]: Requires the installation of the @runcomfy/cli package from the NPM registry to function.
  • [CREDENTIALS_UNSAFE]: The skill documents the use of an API token (RUNCOMFY_TOKEN) for authentication. It specifies that the CLI stores the token locally at ~/.config/runcomfy/token.json with restricted filesystem permissions (mode 0600), which is a standard and secure practice for CLI tools.
  • [SAFE]: User-provided prompts and video URLs are passed to the CLI via a structured JSON input string. The skill documentation notes that the CLI does not perform shell expansion on the prompt content, reducing the risk of shell injection. Network communications are restricted to the vendor's official domains (*.runcomfy.net and *.runcomfy.com).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 02:09 AM
Security Audit — agent-trust-hub — video-edit