lipsync
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Utilizes the
runcomfycommand-line interface for model execution. Tool access is appropriately scoped via the platform's frontmatter configuration. - [EXTERNAL_DOWNLOADS]: References the official
@runcomfy/clipackage for installation via the NPM registry, following standard software distribution practices. - [PROMPT_INJECTION]: Identifies the potential for indirect prompt injection via user-provided media URLs and provides explicit guidance for agents to mitigate these risks through careful URL handling and content validation.
- Ingestion points: External media URLs (
video_url,audio_url,image_url) referenced inSKILL.md. - Boundary markers: Uses structured JSON input strings for CLI arguments to prevent shell expansion issues.
- Capability inventory: Access is restricted to the
runcomfyCLI tool. - Sanitization: Documentation specifies that agents should only ingest URLs explicitly provided by the user and notes that the skill itself does not gate inputs, placing responsibility on the operator.
Audit Metadata