ClawHub
Back to skill

Security audit

Lipsync — Pro Pack on RunComfy

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent RunComfy lip-sync helper, but users should be careful because it recommends installing or running an unpinned third-party CLI.

Before installing, pin or review the @runcomfy/cli version, avoid automatic npx execution of mutable latest packages in sensitive environments, use a narrowly scoped RunComfy token, and only process faces and voices where you have consent and rights.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:36
Finding

Unpinned Third-Party CLI Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-41
Vulnerability Type: Supply-chain risk from an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

bash
# 1. Install (see runcomfy-cli skill for details)
npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version

# 2. Sign in
runcomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>

Technical Analysis

The skill instructs the agent to install or execute @runcomfy/cli without specifying an exact reviewed version or verifying package integrity. Both commands resolve a mutable package version from the configured npm registry:

  • npm i -g @runcomfy/cli installs the package globally and can execute npm lifecycle scripts with the privileges of the invoking user.
  • npx -y @runcomfy/cli --version automatically downloads and executes the resolved package without interactive confirmation.
  • The subsequently executed CLI is given access to RunComfy authentication material through runcomfy login or RUNCOMFY_TOKEN.

Consequently, the effective executable may differ from the version originally reviewed. Registry compromise, maintainer-account compromise, malicious package publication, or unsafe registry configuration could cause attacker-controlled code to run locally.

The documented network transfer of user-provided portrait, video, and audio URLs to RunComfy is disclosed and necessary for the declared cloud lip-sync functionality. No instruction was found to enumerate unrelated credentials or upload arbitrary local files. However, the package contains only documentation and not the RunComfy CLI source, so claims concerning endpoint restrictions, token handling, and absence of telemetry cannot be independently verified from this project.

Attack Path

  1. An attacker compromises the npm package, a maintainer account, the package publication process, or the registry used by the environment. 2 ...[truncated 1224 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to an explicitly reviewed version, for example @runcomfy/cli@X.Y.Z, rather than resolving the mutable latest release.
  2. Prefer a project-local dependency governed by a committed lockfile instead of a global installation.
  3. Verify the expected npm registry and package integrity metadata before installation or execution.
  4. Do not use automatic npx -y execution for an uninstalled dependency. Require explicit user approval before downloading and running third-party code.
  5. Review the selected release, including lifecycle scripts and transitive dependencies, before approving it for agent use.
  6. Run the CLI in a sandbox or restricted account with access only to the required input assets, output directory, network destinations, and narrowly scoped token.
  7. Document a tested version and controlled upgrade process so dependency changes receive security review before deployment.
  8. Avoid exposing RUNCOMFY_TOKEN to unrelated subprocesses and rotate the token if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs use of npx -y @runcomfy/cli without pinning a specific package version, which creates a supply-chain risk: the resolved package can change over time and a compromised or malicious newly published version could be executed automatically. In an agent context, npx fetch-and-run behavior is especially sensitive because it can lead to execution of unreviewed code on the host.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
## Consent

Driving a real person's mouth from a separate audio track is dual-use. Refuse user requests that target real public figures without consent, or that aim at defamatory or sexually explicit synthetic media. The skill itself does not gate inputs — the responsibility rests with the operator.

---

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md
## Consent

Driving a real person's mouth from a separate audio track is dual-use. Refuse user requests that target real public figures without consent, or that aim at defamatory or sexually explicit synthetic media. The skill itself does not gate inputs — the responsibility rests with the operator.

---

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The security section repeats the recommendation to use npx -y @runcomfy/cli without an explicit version pin. Even though it warns against arbitrary remote install scripts, this still permits execution of the latest package version from the registry, exposing users to dependency hijack or maintainer compromise risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.