🎞️ Video Inpainting — Pro Pack on RunComfy

PassAudited by ClawScan on May 14, 2026.

Overview

This is a coherent RunComfy video-editing skill, but users should notice that it installs/uses the RunComfy CLI, requires a RunComfy token, and sends video inputs to RunComfy’s cloud service.

Before installing, confirm you trust the official RunComfy CLI, sign in intentionally, and use a token with limited scope if possible. Do not submit private videos unless you are comfortable with RunComfy processing them, and only remove watermarks or edit media when you have the rights to do so.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing a global CLI gives that package code execution on the local machine during install/use.

Why it was flagged

The skill instructs users to install or run the RunComfy CLI from npm. This is central to the stated purpose, but it is still a third-party CLI installation the user should verify.

Skill content

npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version

Recommendation

Install only the official RunComfy CLI from a trusted source and keep it updated; avoid running unexpected npm packages.

Low

#ASI03: Identity and Privilege Abuse

What this means

RunComfy jobs may use the user's account permissions, quota, or billing context.

Why it was flagged

The skill requires RunComfy authentication to submit jobs. This is expected for the service, but it means the agent/CLI can act under the user's RunComfy account.

Skill content

runcomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>

Recommendation

Use the least-privileged token available, keep RUNCOMFY_TOKEN private, and revoke or rotate it if it may have been exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Video content, URLs, and prompts may be processed by RunComfy rather than staying local.

Why it was flagged

The workflow sends a video URL and edit prompt to RunComfy model endpoints. This is disclosed and purpose-aligned, but it crosses a cloud-provider data boundary.

Skill content

runcomfy run wan-ai/wan-2-7/edit-video ... --input '{"video_url": "...", "prompt": "..."}'

Recommendation

Only use videos you are comfortable sending to RunComfy, and avoid sensitive or private media unless RunComfy's terms and privacy controls meet your needs.