Video Extend — Pro Pack on RunComfy

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent RunComfy video-extension helper, with disclosed CLI, network, and token use, but users should be cautious about the unpinned npm install path.

Before installing, verify the @runcomfy/cli package source and consider pinning a reviewed version instead of running unversioned npm or npx commands. Use a token with only the access you need, avoid placing secrets in prompts or logs, and only extend video URLs you intentionally provide.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39
• Finding: Unpinned Third-Party CLI Installation and Automatic Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 39 **Vulnerability Type**: Unpinned third-party dependency installation and execution **Risk Level**: Medium ```bash npm i -g @runcomfy/cli # or: npx -y @runcomfy/cli --version ``` ### Technical Analysis The documented commands retrieve `@runcomfy/cli` without specifying an exact reviewed version or package integrity value. Consequently, npm resolves whichever release is current when the command is run rather than the version that was available during this audit. The `npx -y` alternative is particularly sensitive because it automatically approves package retrieval and executes the resolved package. The global installation command can also execute npm lifecycle scripts during installation. If the package publisher account, package release process, registry response, or a transitive dependency is compromised, newly introduced code could execute locally without any corresponding change to this reviewed skill file. This is a supply-chain exposure rather than evidence that the current `@runcomfy/cli` package is malicious. The CLI source and dependency metadata were not included in the audited project, so its implementation and package integrity could not be independently verified. ### Attack Path 1. An attacker compromises the package publisher, release process, npm registry delivery path, or a transitive dependency. 2. The attacker publishes or causes npm to resolve a malicious release of `@runcomfy/cli` or one of its dependencies. 3. A user or agent follows the instruction in `SKILL.md` and runs the unversioned `npm i -g` or automatic `npx -y` command. 4. npm downloads the attacker-controlled version because no exact version or integrity constraint is specified. 5. Malicious lifecycle scripts or package code execute with the privileges of the invoking user. 6. The malicious code may access files, environment variables, CLI credentials, and network resources available to that user. ...[truncated 717 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a reviewed exact version, for example: ```bash npm install --global @runcomfy/cli@X.Y.Z npx --yes @runcomfy/cli@X.Y.Z --version ``` 2. Document the expected package integrity digest and verify the downloaded package before execution where the installation workflow supports it. 3. Verify npm package provenance, publisher identity, signatures or attestations, and release checksums before approving version updates. 4. Review dependency changes whenever the pinned CLI version is upgraded. 5. Prefer a project-local dependency governed by a committed lockfile over an unconstrained global installation when operationally practical. 6. Disable npm lifecycle scripts during installation where compatible: ```bash npm install --global --ignore-scripts @runcomfy/cli@X.Y.Z ``` Confirm first that the package does not legitimately require an installation script. 7. Execute the CLI as an unprivileged user in a constrained environment with access only to the required input, output directory, and token. 8. Avoid running either installation command with `sudo` or an administrator account. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest lists several specific trigger phrases, but then broadens activation to "any explicit ask to take an existing video and add more frames after it." That catch-all condition is ambiguous and lacks clear boundaries or exclusion examples, which could cause the skill to match a wide range of ordinary requests about editing or lengthening video.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence
• Finding: The skill recommends executing `npx -y @runcomfy/cli` without pinning a specific version, which allows whatever the latest published package is at execution time to run on the user's system. If the package is compromised upstream, typosquatted, or a malicious version is published, the agent/operator could execute attacker-controlled code during setup.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence
• Finding: In the security section, the skill still endorses `npx -y @runcomfy/cli` as a safe install path without version pinning. Even though the surrounding guidance is security-conscious, invoking an unpinned remote package still creates a supply-chain execution risk because the fetched code can change over time.

Static analysis

No suspicious patterns detected.