lipsync
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents the installation of the
@runcomfy/clipackage from the official NPM registry. This is a verified vendor-owned resource required for the skill's primary functionality. - [COMMAND_EXECUTION]: Uses the
runcomfycommand-line tool to invoke various lip-sync models. Tool access is restricted to theruncomfybinary via theallowed-toolsplatform configuration, which prevents the execution of unauthorized shell commands. - [CREDENTIALS_UNSAFE]: Provides instructions for managing API tokens using standard practices, such as environment variables or local configuration files (
~/.config/runcomfy/token.json) with appropriate file permissions (mode 0600). - [PROMPT_INJECTION]: Contains instructional content that reinforces safety guidelines by requiring consent for media generation involving real people. This aligns with ethical AI usage and does not attempt to bypass existing safety protocols.
Audit Metadata