video-outpainting
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the
@runcomfy/clipackage from the NPM registry. This package is the official command-line tool for the RunComfy service. - [CREDENTIALS_UNSAFE]: The skill identifies the storage path for API tokens at
~/.config/runcomfy/token.json. This is documented as the standard configuration location for the vendor's CLI tool and is managed with restricted file permissions. - [PROMPT_INJECTION]: The skill notes the risk of indirect prompt injection from processing external video URLs. It provides remediation guidance, such as only processing user-verified URLs and monitoring for unexpected model behavior.
- [COMMAND_EXECUTION]: The skill utilizes the
runcomfycommand-line interface to interact with model endpoints. The implementation includes documentation on how the CLI manages input boundaries to prevent shell injection during execution.
Audit Metadata