wan-2-7
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages the
runcomfycommand-line interface to perform video generation tasks by executingruncomfy run wan-ai/wan-2-7/text-to-videowith parameters derived from user instructions. - [EXTERNAL_DOWNLOADS]: The skill instructions direct users to install the
@runcomfy/clipackage from the NPM registry as a prerequisite for its operation. - [PROMPT_INJECTION]: The skill includes an attack surface for indirect prompt injection as it processes untrusted user-supplied data.
- Ingestion points: The
promptandaudio_urlfields in theSKILL.mdfile are points where user-provided content enters the execution flow. - Boundary markers: The documentation specifies that the CLI passes input as a JSON object, which helps prevent shell-level injection, though it depends on the remote model's safety filters for content-level injection.
- Capability inventory: The skill uses CLI execution to send data to and receive results from the
model-api.runcomfy.netand*.runcomfy.comdomains. - Sanitization: The CLI tool encapsulates inputs within a JSON structure to provide a clear boundary before transmitting the data via HTTPS.
Audit Metadata