image-to-video
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
runcomfyCLI tool. It utilizes structured JSON input via the--inputflag, which is a defensive pattern against shell command injection when processing user-provided prompts. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@runcomfy/cliNode.js package from the official registry. Generated media assets are downloaded from the vendor's domains (runcomfy.netandruncomfy.com). - [DATA_EXFILTRATION]: User-provided assets such as images and audio URLs, along with text prompts, are transmitted to the RunComfy Model API for processing. This is a core requirement for the skill's functionality.
- [CREDENTIALS_UNSAFE]: The skill documents the location of the API token at
~/.config/runcomfy/token.jsonand notes that it is stored with restrictive permissions (0600). It also suggests using environment variables for CI/CD environments, which is a standard security best practice for CLI credential management.
Audit Metadata