video-edit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text through the user-provided prompt field (passed via --input JSON to runcomfy run <model_id> and sent to the Model API), with no requirement to pre-select trusted provider-authored content first.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill accepts user-supplied media URLs that are fetched at runtime by the RunComfy model servers (e.g., https://.../speaker.mp4), and the README explicitly warns that image/video content can perform image-based prompt injection that influences model outputs, so these external URLs can directly affect prompts during execution.