ElevenLabs AI Music Generation — Pro Pack on RunComfy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for generating music through RunComfy, but its setup guidance asks users to install or execute an unpinned third-party CLI that can change after review.

Review the RunComfy CLI package before installing, prefer a pinned reviewed version instead of npx -y or an unpinned global install, and run it with only the RunComfy token and project directories needed for music generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41

Finding

Unpinned Third-Party CLI Installation and Automatic Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:41-42
Vulnerability Type: Unpinned and automatically executed third-party dependency
Risk Level: Medium

Vulnerable Code

bash

npm i -g @runcomfy/cli                              # global install
npx -y @runcomfy/cli --version                      # zero-install

The same unsafe installation options are endorsed again at SKILL.md:176:

text

Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`.

Technical Analysis

Both commands resolve @runcomfy/cli without specifying an exact reviewed version. Consequently, the code installed or executed may change after the Skill has been audited.

The npx -y command is particularly risky because it automatically downloads and executes the currently resolved package without interactive confirmation. Package installation may also execute npm lifecycle scripts. The global installation alternative persists the resolved package in the user's global npm environment, increasing the duration and scope of exposure.

If the package publisher account, npm package, dependency tree, or distribution process is compromised, following these instructions could execute attacker-controlled code with the privileges of the user running npm. The Skill's warning against arbitrary shell installation scripts does not mitigate this package-resolution risk.

Attack Path

1. An attacker compromises the @runcomfy/cli package, its publisher account, or one of its transitive dependencies.
2. The attacker publishes a malicious release that is selected by npm's default version resolution.
3. A user or agent follows SKILL.md and runs the unpinned npm i -g or npx -y command.
4. npm downloads the compromised package and may execute malicious lifecycle scripts.
5. With npx -y, the downloaded CLI is then executed automatically without confirmation.
6. The malicious code operates with the invoking user's permis ...[truncated 966 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @runcomfy/cli to an exact version that has been reviewed, rather than relying on npm's current default resolution:

   bash

   npm install --global @runcomfy/cli@<reviewed-exact-version>
   

2. Remove or discourage npx -y, because it combines remote retrieval with non-interactive execution. Require explicit operator approval before downloading or running a previously absent package.

3. Publish and verify the expected package integrity hash. For reproducible deployments, use a lockfile and an installation mode that enforces it, such as npm ci.

4. Document the expected package publisher, registry, exact version, and checksum so operators can verify provenance before execution.

5. Prefer a project-local, pinned dependency over a global installation to reduce persistence and scope.

6. Run the CLI in a restricted environment with only the necessary output-directory access and the required RunComfy credential. Do not expose unrelated credentials or sensitive directories to the process.

7. Review dependency and release changes before updating the pinned version, and use automated supply-chain scanning for the package and its transitive dependencies.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest lists generic triggers such as "make a song," "background music," "compose," and especially "any explicit ask to generate music or a song from a text description." These phrases overlap with common user requests and do not provide clear exclusion conditions or narrower activation scope, which increases the risk of the skill activating in unintended contexts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The documentation recommends executing npx -y @runcomfy/cli without a pinned version, which causes the latest package version to be fetched and run at execution time. If the upstream package is compromised, a malicious version is published, or a breaking change is introduced, users may execute unexpected code on their local machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The security section explicitly permits npx -y @runcomfy/cli as a trusted install path, but this still executes an unpinned package from the registry. That creates a supply-chain risk because the resolved code can change over time and may be malicious or simply unsafe due to regressions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.