🎬 AI Video Generation β€” Pro Pack on RunComfy

PassAudited by ClawScan on May 13, 2026.

Overview

This appears to be a purpose-aligned RunComfy video-generation skill, but users should understand it requires the RunComfy CLI, account token, and may send prompts or media references to RunComfy.

This skill looks coherent and purpose-aligned. Before installing, verify the RunComfy CLI package source, use a protected RunComfy token, and avoid sending sensitive prompts, images, audio, or videos unless you accept RunComfy’s data handling and any usage costs.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the CLI gives third-party package code local execution capability, which is expected but should come from the official source.

Why it was flagged

The skill relies on installing or running an external npm CLI package. This is purpose-aligned, but the package is not bundled or pinned by the skill artifact.

Skill content
npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version
Recommendation

Install the RunComfy CLI only from official RunComfy documentation or a trusted npm source, and avoid running unexpected package versions.

What this means

The skill can use the configured RunComfy account/token to submit video-generation jobs, which may consume credits or access account resources.

Why it was flagged

The skill needs a RunComfy credential/configuration to call the service. That is expected for video generation, but it is still delegated account access.

Skill content
Required env vars: RUNCOMFY_TOKEN; Required config paths: ~/.config/runcomfy
Recommendation

Use a dedicated or scoped token if RunComfy supports it, protect the token from logs or shared chats, and monitor account usage.

What this means

The agent may choose and run a RunComfy model endpoint for a user’s video request, producing files in the chosen output directory and potentially incurring service usage.

Why it was flagged

The skill documents local CLI execution against selectable RunComfy model endpoints. This is the core function and appears scoped to video generation.

Skill content
runcomfy run <vendor>/<model>/<endpoint> \
  --input '{"prompt": "..."}' \
  --output-dir ./out
Recommendation

Review the selected model, prompt/assets, output directory, and expected cost before running expensive or sensitive jobs.

What this means

Prompts and any supplied image, video, or audio references may be processed by RunComfy or its model providers.

Why it was flagged

The skill supports provider-side generation using supplied media references. This is disclosed and purpose-aligned, but users should treat those inputs as data sent to an external service.

Skill content
multi-modal (up to 9 reference images, 3 reference videos, 3 reference audio)
Recommendation

Do not submit private or regulated media unless you are comfortable with RunComfy’s handling terms and retention policies.