video-outpainting
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the
@runcomfy/clitool from the NPM registry to enable its core functionality. - [COMMAND_EXECUTION]: The skill uses the
runcomfyCLI tool to execute video processing workflows on the RunComfy platform. - [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it processes external content from user-provided URLs.
- Ingestion points: The
video_urlparameter in the CLI input JSON (SKILL.md). - Boundary markers: Data is passed within a structured JSON object to the CLI command.
- Capability inventory: The skill utilizes the
runcomfyCLI and makes network requests to vendor APIs. - Sanitization: The documentation claims the CLI avoids shell-expansion for the input JSON, which serves as a mitigation for direct command injection.
Audit Metadata