comfy-minimax-videogen
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data via prompts and interpolates them into command-line executions.
- Ingestion points: User-provided prompts passed to the
--promptargument incomfy-videogencommands as shown inSKILL.md. - Boundary markers: Absent; there are no instructions to wrap or delimit user input to prevent it from being interpreted as part of the command structure.
- Capability inventory: The skill relies on
uv runto execute shell commands for video generation and model management. - Sanitization: Absent; the skill does not specify any validation or escaping mechanisms for the user-supplied prompts.
- [COMMAND_EXECUTION]: The skill's core functionality relies on executing external command-line tools (
comfy-videogen,comfy-models,comfy-tools-setup) using theuvrunner. These commands interact with the local file system and manage model downloads.
Audit Metadata