Security audit

Image-to-Video — Pro Pack on RunComfy

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly disclosed RunComfy media-generation skill, but one advertised image-and-audio lip-sync route actually calls a text-to-video endpoint without using an image.

Review this skill before installing if you need reliable identity-preserving lip-sync. The general and multi-modal routes are disclosed as RunComfy API calls, but the lip-sync route should be corrected or treated as text-to-video with audio, not true image-to-video from a supplied image.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill advertises a lip-sync image-to-video flow that supposedly uses an input image, but the documented command actually invokes a text-to-video endpoint with only prompt and audio. This mismatch can cause the agent to route user data to the wrong model, produce misleading outputs, and violate user expectations about identity preservation and media handling.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The documentation explicitly says the lip-sync route takes image plus audio, but the schema and example omit any image input. In an agent skill, this kind of interface deception is dangerous because downstream automation may collect or promise handling of a source image that is never used, leading to incorrect routing, broken guarantees, and accidental disclosure of user media under false pretenses.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill claims all routes use an image-to-video endpoint pattern, but one documented route uses a text-to-video endpoint instead. This inconsistency can mislead the agent's tool-selection logic and operators reviewing the skill, increasing the chance of incorrect model invocation and unsafe assumptions about what data is processed.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger includes a broad catch-all phrase covering essentially any explicit request for image-to-video conversion. Overbroad activation in an agent skill increases the risk of unintended invocation, especially when the skill has inconsistent route definitions and handles external media URLs and tokens.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The routing guidance uses ambiguous examples like 'make a video from this' or 'showed an image and asked for video,' which may cause the agent to over-trigger without sufficient validation of inputs or user intent. In this context, misrouting matters because the skill may then call the wrong endpoint or process third-party URLs based on incomplete assumptions.

Static analysis

No suspicious patterns detected.