video-inpainting
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
@runcomfy/clipackage from the official npm registry. This tool is the primary mechanism for the skill's functionality and is managed by the service provider described in the documentation. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes external media content.
- Ingestion points: Untrusted data enters the agent context via the
video_urlparameter in theruncomfy runcommand. - Boundary markers: There are no technical delimiters used for the input URL; however, the skill documentation includes explicit warnings for the agent to only process user-provided URLs.
- Capability inventory: The skill uses the
runcomfyCLI which performs network requests to external APIs and writes files to the local system. - Sanitization: No automated sanitization or filtering of the external video content or its metadata is performed prior to processing.
- [COMMAND_EXECUTION]: The skill executes the
runcomfyCLI tool. The frontmatter configuration limits the scope of shell access to this specific command, which follows the principle of least privilege.
Audit Metadata