wan-2-7
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the
@runcomfy/clipackage, which is the standard tool for interacting with the RunComfy API. It also references a GitHub repository for skill management. - [DATA_EXFILTRATION]: Credential management follows best practices, utilizing either the
RUNCOMFY_TOKENenvironment variable or a configuration file (~/.config/runcomfy/token.json) with restricted permissions (0600). - [COMMAND_EXECUTION]: The skill executes the
runcomfyCLI to process video generation requests. The documentation explicitly notes that the CLI avoids shell-expansion of user prompts to prevent injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill allows the inclusion of an
audio_urlfor lip-syncing. As this involves processing external data, it represents a standard indirect injection surface, which the documentation acknowledges as a risk inherent to multi-modal models.
Audit Metadata