Image-to-Video — Pro Pack on RunComfy

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed RunComfy image-to-video helper with some normal third-party service and install risks, but no evidence of hidden or malicious behavior.

Install only if you are comfortable sending image, video, audio URLs and prompts to RunComfy. Prefer a pinned or reviewed CLI version, avoid running npm install with elevated privileges, use a revocable RunComfy token, and confirm ambiguous video requests before invoking the skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:69

Finding

Unpinned Global Installation of a Third-Party CLI Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 69
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet:

markdown

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

Technical Analysis

The installation command retrieves the latest available version of @runcomfy/cli from the configured npm registry. It does not specify an exact version, lock the resolved dependency tree, or verify package integrity against a documented checksum.

Because npm packages may execute lifecycle scripts during installation, the effective code executed by this command can change after the Skill has been reviewed. The global installation option also places the package into the user's global npm environment, increasing its reach beyond the project directory. This creates a supply-chain risk if the package, its publishing account, one of its transitive dependencies, or the configured registry is compromised.

The audit did not establish that the current package is malicious. The vulnerability is the unsafe, mutable dependency-installation procedure.

Attack Path

1. An attacker compromises the npm package, a maintainer account, a transitive dependency, or the registry resolution path.
2. The attacker publishes a malicious version that becomes the version selected by the unpinned installation command.
3. A user follows the documented prerequisite and runs npm i -g @runcomfy/cli.
4. npm downloads the attacker-controlled package and may execute its installation lifecycle scripts with the installing user's privileges.
5. The malicious package can persist in the user's global npm installation and execute again when the runcomfy command is invoked.
6. If accessible to that user, the malicious code could read RUNCOMFY_TOKEN or ~/.config/runcomfy/token.json, access other user-readable files, modify user-writable resources, or submit unauthorized API reque ...[truncated 739 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact, reviewed version, for example:

   bash

   npm install --global @runcomfy/cli@X.Y.Z
   

2. Document the expected package provenance and integrity value, and verify the downloaded package before installation.

3. Prefer a project-local dependency with a committed lockfile over a global installation so the resolved dependency graph remains reproducible.

4. Review the pinned package and its transitive dependencies for lifecycle scripts and known vulnerabilities.

5. Where compatible with the package, disable lifecycle scripts during installation:

   bash

   npm install --global --ignore-scripts @runcomfy/cli@X.Y.Z
   

6. Do not run the installation with administrative privileges unless strictly necessary.

7. Execute the CLI in a restricted environment with access only to required media, output directories, network destinations, and credentials.

8. Use a narrowly scoped, revocable RunComfy token and rotate it if package compromise is suspected.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger text is broad enough to match generic requests like 'make a video from image' or 'any explicit ask for image-to-video conversion,' which can cause the skill to activate when a user did not specifically intend to use RunComfy or this particular workflow. Unintended invocation can route sensitive user content or URLs to a third-party API and override a more appropriate local or safer skill, creating privacy and operational risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The routing guidance instructs the agent to route broad phrases such as 'make a video from this' or cases where a user merely 'showed an image and asked for video' without clear disambiguation. In context, this increases the chance of misrouting ambiguous user requests into an external image-to-video generation service, potentially sending user-provided media and prompts off-platform without sufficient specificity or consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.