comfy-motion-track-control

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill instructions and associated commands were analyzed, and no malicious patterns, obfuscation techniques, or unauthorized security-sensitive operations were found.
  • [COMMAND_EXECUTION]: The skill utilizes local CLI tools (comfy-videogen, comfy-models) via the standard uv runner to perform video generation and manage models. These operations are restricted to the intended purpose of the skill and do not involve unauthorized shell execution.
  • [EXTERNAL_DOWNLOADS]: The skill describes downloading model checkpoints from Lightricks, a well-known organization in the AI space, using a project-specific downloader. These downloads target official model weights and do not include untrusted or unverifiable scripts.
  • [PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection as it processes user-supplied prompts for video generation. However, these prompts are consumed by the LTX 2.3 generation model as data and do not influence the agent's control flow or execution logic.
  • Ingestion points: User-supplied --prompt string, image, and video files (SKILL.md).
  • Boundary markers: None explicitly defined in the CLI command examples.
  • Capability inventory: Local subprocess execution of the comfy-videogen CLI.
  • Sanitization: Not explicitly defined within the skill documentation; relies on the underlying CLI tool's handling of arguments.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 12:13 AM
Security Audit — agent-trust-hub — comfy-motion-track-control