Wan 2.7 — Pro Pack on RunComfy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for RunComfy video generation, but it asks users to install an unpinned global CLI that will handle account tokens and media prompts.

Review the RunComfy CLI before installing, prefer a pinned or local install where possible, and use a scoped token you can rotate. Avoid sending sensitive prompts, private media URLs, or long-lived credentials unless you trust the RunComfy service and npm package provenance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Unpinned Global Installation of a Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:48-52
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

markdown

## Prerequisites

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.

Technical Analysis

The installation command retrieves the current version of @runcomfy/cli from the configured npm registry without pinning a reviewed version or verifying package integrity or provenance. The -g option installs the package globally and runs npm lifecycle scripts with the invoking user's privileges.

This creates a mutable supply-chain boundary: the code installed when a user follows the instructions may differ from the version that existed when the Skill was reviewed. The CLI subsequently handles sensitive resources, including RUNCOMFY_TOKEN, ~/.config/runcomfy/token.json, user prompts, media URLs, generated files, and network requests.

The audit cannot verify the documentation's claims about endpoint restrictions, token handling, telemetry, shell-injection resistance, or download limits because the CLI source is not included in the project.

Attack Path

1. An attacker compromises the npm package, a maintainer account, the publishing pipeline, or the registry resolution path.
2. The attacker publishes a malicious release under the expected @runcomfy/cli package name.
3. A user follows the documented command npm i -g @runcomfy/cli.
4. npm resolves and installs the malicious latest release and may execute its lifecycle scripts.
5. The malicious package executes with the user's privileges.
6. It can read accessible credentials and files, including the RunComfy token, and transmit prompts, media locations, or other data to attacker-controlled infrastructure.
7. Because the command performs a global instal ...[truncated 1231 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specifically reviewed version, for example:

   bash

   npm install --global @runcomfy/cli@<reviewed-version>
   

2. Publish and verify expected package integrity information and provenance, including the official registry, package publisher, release signature, and checksum where supported.

3. Prefer a project-local installation with a lockfile over a global installation, then invoke the pinned binary through an explicit local path or package script.

4. Review npm lifecycle scripts before installation. Where compatible with the package, consider disabling lifecycle scripts during installation and enabling only the explicitly required setup steps.

5. Run the CLI under a dedicated, minimally privileged account or isolated container with access only to the required output directory and credentials.

6. Scope and rotate RunComfy tokens. Avoid exposing unrelated environment variables or home-directory files to the CLI process.

7. Document third-party data handling and obtain user confirmation before submitting sensitive prompts, private audio, or signed media URLs.

8. Include the reviewed CLI source or a verifiable source reference so its endpoint allowlist, token storage, telemetry behavior, URL handling, and download restrictions can be independently audited.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest lists specific triggers, but then broadens activation to "any explicit ask to generate video with this model," which is not concretely bounded. This can create ambiguity about when the skill should activate versus when other video-generation skills should be chosen.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.