⏭️ Video Extend — Pro Pack on RunComfy

PassAudited by ClawScan on May 14, 2026.

Overview

This skill is a straightforward RunComfy video-extension helper, but it uses your RunComfy account/token and sends a chosen video URL and prompt to an external generation service.

Before installing, make sure you trust the RunComfy CLI, understand that video URLs and prompts are submitted to RunComfy/Google Veo endpoints, and confirm any cost or credit usage before chaining multiple video extensions.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A RunComfy job may be launched using the provided video URL and prompt, and generated files may be saved to the local output directory.

Why it was flagged

The skill directs the agent to invoke an external video-generation job and write outputs locally; this is central to the skill's purpose but should be user-directed because it can process media and potentially consume service credits.

Skill content
runcomfy run google-deepmind/veo-3-1/extend-video --input '{"video_url": "https://...", "prompt": "..."}' --output-dir ./out
Recommendation

Use the skill only when you intend to submit the selected video to RunComfy, and review endpoint choice and likely cost before running multiple extends.

What this means

Anyone or any agent action using this skill with your environment can submit jobs through your RunComfy account.

Why it was flagged

The skill requires a RunComfy token and CLI config, which is expected for this integration but gives the CLI delegated access to the user's RunComfy account.

Skill content
clawdis:\n  requires:\n    bins:\n      - runcomfy\n    env:\n      - RUNCOMFY_TOKEN\n    config:\n      - ~/.config/runcomfy
Recommendation

Keep the token scoped and protected, rotate it if exposed, and avoid running the skill in untrusted environments.

What this means

Installing or running the CLI executes software from the npm ecosystem on the user's machine.

Why it was flagged

The documented setup relies on an external npm package rather than bundled reviewed code; this is purpose-aligned for a CLI-based skill but means trust depends on the RunComfy CLI package source.

Skill content
npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version
Recommendation

Install the CLI from the official RunComfy source, consider pinning a known version, and review npm package provenance if using it in sensitive environments.