comfy-motion-track-control
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions and associated commands were analyzed, and no malicious patterns, obfuscation techniques, or unauthorized security-sensitive operations were found.
- [COMMAND_EXECUTION]: The skill utilizes local CLI tools (
comfy-videogen,comfy-models) via the standarduvrunner to perform video generation and manage models. These operations are restricted to the intended purpose of the skill and do not involve unauthorized shell execution. - [EXTERNAL_DOWNLOADS]: The skill describes downloading model checkpoints from Lightricks, a well-known organization in the AI space, using a project-specific downloader. These downloads target official model weights and do not include untrusted or unverifiable scripts.
- [PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection as it processes user-supplied prompts for video generation. However, these prompts are consumed by the LTX 2.3 generation model as data and do not influence the agent's control flow or execution logic.
- Ingestion points: User-supplied
--promptstring, image, and video files (SKILL.md). - Boundary markers: None explicitly defined in the CLI command examples.
- Capability inventory: Local subprocess execution of the
comfy-videogenCLI. - Sanitization: Not explicitly defined within the skill documentation; relies on the underlying CLI tool's handling of arguments.
Audit Metadata