happyhorse-1-0
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
runcomfyCLI tool to interact with the RunComfy Model API for video generation and status polling. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@runcomfy/clipackage from NPM, which is the official tool provided by the vendor for accessing their services. - [PROMPT_INJECTION]: The skill processes user-supplied text prompts as input for video generation. It implements an indirect prompt injection surface where external data is ingested.
- Ingestion points: User input is accepted for the
promptfield and passed to theruncomfyCLI. - Boundary markers: User prompts are encapsulated within a JSON string using the
--inputflag to ensure they are treated as data rather than executable shell commands. - Capability inventory: The skill performs network operations to
model-api.runcomfy.netand writes generated video files to a local directory defined by the--output-dirparameter. - Sanitization: The documentation specifies that the CLI transmits the JSON body directly to the Model API over HTTPS without performing shell expansion on the prompt content, mitigating shell injection risks.
Audit Metadata