Skills
skills/skills-collective/skills/video-inpainting/Gen Agent Trust Hub

video-inpainting

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documents the installation of the official @runcomfy/cli package via the standard NPM registry.
  • [COMMAND_EXECUTION]: The execution environment is restricted to the runcomfy command through the allowed-tools configuration, minimizing the risk of arbitrary shell command execution.
  • [SAFE]: The skill includes a dedicated security section addressing potential risks. It explicitly documents the location of authentication tokens (~/.config/runcomfy/token.json) and explains the JSON-based input handling designed to prevent shell injection.
  • [PROMPT_INJECTION]: The skill provides a mandatory evidence chain for indirect prompt injection surface assessment:
  • Ingestion points: The video_url field in the CLI command input (SKILL.md).
  • Boundary markers: The skill uses JSON string passing to isolate inputs and provides explicit instructions for the agent to only ingest user-provided URLs.
  • Capability inventory: Uses the runcomfy CLI tool for video processing.
  • Sanitization: Relies on JSON encoding to avoid shell expansion of prompt or URL content.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 07:37 AM
Security Audit — agent-trust-hub — video-inpainting