Video Edit — Pro Pack on RunComfy

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.0

Overview

This is a disclosed RunComfy video-edit skill, with the main risks being third-party media processing and trust in the RunComfy CLI installation.

Install only if you are comfortable sending source video URLs, prompts, and optional reference images to RunComfy for processing. Prefer a pinned or locally scoped @runcomfy/cli install where possible, protect the RunComfy token, and use this skill only for videos you are allowed to upload to a third-party service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:86

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 86
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

npm i -g @runcomfy/cli

Technical Analysis

The documented prerequisite installs the mutable latest version of @runcomfy/cli globally without a version or integrity pin. Consequently, the code installed by this instruction may differ from the version originally reviewed.

npm packages may execute lifecycle scripts during installation with the permissions of the invoking user. If the package publisher account, registry distribution channel, or a future package release is compromised, following this instruction could execute attacker-controlled code. The global installation scope also makes the resulting executable available beyond the current project.

The audit found no evidence that @runcomfy/cli is currently malicious. This finding concerns the unsafe dependency installation method and its exposure to future supply-chain compromise.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or another relevant supply-chain component for @runcomfy/cli.
2. The attacker publishes a malicious release as the latest package version.
3. A user follows the prerequisite in SKILL.md and runs npm i -g @runcomfy/cli.
4. npm retrieves the attacker-controlled release because no reviewed version is pinned.
5. Malicious package code or lifecycle scripts execute with the installing user's privileges.
6. The globally installed runcomfy executable may continue executing attacker logic in later invocations.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user performing the installation. Depending on that user's access, an attacker could read or alter user-accessible files, steal environment variables or locally stored credentials such as RunComfy tokens, manipu ...[truncated 273 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specifically reviewed release:

   bash

   npm install -g @runcomfy/cli@X.Y.Z
   

2. Document the approved version and update it only after reviewing release provenance, package contents, dependencies, and lifecycle scripts.
3. Publish and verify the expected package integrity digest or signed provenance where supported.
4. Prefer a project-local dependency governed by a committed lockfile instead of a global installation when operationally practical.
5. In automated environments, use a trusted internal registry mirror or an allowlisted artifact repository.
6. Run installation and execution as a dedicated, least-privileged user without access to unrelated credentials or sensitive files.
7. Consider disabling npm lifecycle scripts during installation if the verified CLI does not require them, and separately verify that the installed executable remains functional.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: video-edit-runcomfy
displayName: "🫧 Video Edit — Pro Pack on RunComfy"
description: >
  Video edit on RunComfy. This video edit skill transforms an existing
  video clip — restyle, background swap, outfit swap, motion transfer,
  color grade, or any other video edit task — by routing the video edit
  request to the right model in the RunComfy catalog. Video edit

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger metadata activates on very broad phrases like "video edit", "edit video", and even any explicit ask to edit a video, which can cause the skill to capture requests that may be better handled by a safer or more specific workflow. Over-broad routing increases the chance of unintended execution against user-supplied URLs and prompts, expanding the attack surface for downstream misuse or policy bypass through misclassification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The usage guidance instructs the agent to route broadly whenever the user says common phrases such as "edit video" or "swap the background," without requiring validation that the task truly fits this skill. In an agent ecosystem, such broad routing can lead to unintended invocation, confused-deputy behavior, and processing of attacker-controlled media URLs by an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.