Video Outpainting — Pro Pack on RunComfy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for RunComfy video outpainting, but users should review it because it recommends running an unpinned third-party CLI installer/executor.

Before installing, prefer a pinned and reviewed `@runcomfy/cli` version, avoid unpinned `npx -y` in automated agent runs, keep the RunComfy token scoped and protected, and only process video URLs you intended to send to RunComfy.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party CLI Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–40
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

# 1. Install (see runcomfy-cli skill for details)
npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version

Technical Analysis

The documented commands install or execute the current registry-resolved version of @runcomfy/cli without pinning an audited version or verifying an integrity digest.

npm i -g may execute package lifecycle scripts with the invoking user's privileges and makes the package globally available. The alternative npx -y command automatically downloads and executes the resolved package without interactive confirmation. The scoped package name is consistent with the declared vendor, but the instructions provide no immutable version, checksum, lockfile, or other mechanism to ensure that the executed artifact is the version that was reviewed.

This creates a software supply-chain exposure: a compromised registry account, malicious future release, or compromised transitive dependency could cause arbitrary package-controlled code to run locally.

Attack Path

1. An attacker compromises the package publisher, registry distribution path, a future package release, or a transitive dependency.
2. The attacker publishes a malicious version under the expected package name.
3. A user or agent follows the Skill's unpinned npm i -g or npx -y instruction.
4. npm resolves and retrieves the attacker-controlled release.
5. Package lifecycle scripts or CLI startup code execute with the privileges of the invoking user.
6. The malicious code accesses user-readable files, environment variables, or credentials such as RUNCOMFY_TOKEN, or modifies the user's environment.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. The accessible scope may ...[truncated 275 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a specifically reviewed version, for example @runcomfy/cli@x.y.z.
• Record and verify the expected package integrity digest or use a lockfile-backed installation process.
• Avoid automatic execution through unpinned npx -y.
• Prefer a project-local, least-privilege installation over a global installation where practical.
• Disable lifecycle scripts during installation if the package supports safe operation without them, then invoke only the reviewed entry point.
• Document the authoritative package publisher and registry provenance.
• Review pinned releases and their transitive dependency changes before updating.
• Run the CLI in a restricted environment with only the necessary files and credentials available.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger includes broad natural-language activation such as 'any explicit ask to extend a video spatially beyond its original frame,' which can cause the skill to activate in loosely related contexts. Over-broad routing can make an agent invoke external tooling unexpectedly, increasing the chance of unintended data handling, token use, or network access on content that the user did not intend to process with this skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to execute npx -y @runcomfy/cli without pinning a specific version, which allows whatever package version is current at execution time to run with the user's privileges. If the package is compromised, a malicious version is published, or a dependency supply-chain issue occurs, this can lead to arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Although the surrounding text warns against remote shell scripts, it still recommends npx -y @runcomfy/cli without a pinned version. npx fetches and executes the package dynamically, so using an unpinned package introduces a supply-chain execution risk equivalent to running unreviewed latest code from the registry.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.