kling-3-0
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
runcomfyCLI tool to process video generation requests. It utilizes a JSON-based input mechanism (--input) to pass user-defined parameters, which mitigates the risk of shell-level command injection. - [EXTERNAL_DOWNLOADS]: The skill requires the
@runcomfy/clipackage to be installed from the npm registry. During operation, it downloads resulting media files exclusively from the vendor's verified domains, specifically*.runcomfy.netand*.runcomfy.com. - [CREDENTIALS_UNSAFE]: The skill describes standard authentication methods using an API token, either through a local configuration file (
~/.config/runcomfy/token.json) or an environment variable (RUNCOMFY_TOKEN). No hardcoded secrets or unauthorized credential access patterns were detected.
Audit Metadata