runway

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 0.2.9

Overview

The skill coherently helps generate Runway videos through RunAPI, with disclosed use of an external CLI, credentials, uploads, and media downloads.

Install only if you are comfortable trusting RunAPI's CLI distribution and giving RunAPI access to the media files you choose for requests. Use a dedicated API key, avoid running it in a highly sensitive network environment, review the installed runapi source/version when possible, and watch for paid task submission because the skill sends real generation requests.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Executable Installed from a Third-Party Homebrew Tap## Vulnerability Details **File Location**: `SKILL.md`, lines 13–17 **Vulnerability Type**: Supply-chain risk from an unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml install: - kind: brew formula: runapi-ai/tap/runapi bins: - runapi ``` ### Technical Analysis The Skill instructs the environment to install the `runapi` executable from the custom Homebrew tap `runapi-ai/tap` without specifying an immutable version, source revision, checksum, or signature verification requirement. Because the dependency is mutable, the code installed in the future may differ from the code reviewed when this Skill was audited. If the tap repository, its release infrastructure, or its referenced artifacts are compromised, an attacker could distribute a modified formula or executable. Homebrew installation procedures can execute formula-defined build and installation logic, while the resulting `runapi` binary is subsequently trusted by the Skill for authentication, local-file processing, API requests, and task execution. This finding does not establish that the current package is malicious. It identifies an avoidable supply-chain trust boundary caused by installing and executing an unpinned external component. ### Attack Path 1. An attacker compromises the custom Homebrew tap, its maintainer account, or an artifact hosting location referenced by the formula. 2. The attacker publishes a modified formula or replaces the package artifact while retaining the expected package name. 3. A user installs or updates `runapi-ai/tap/runapi` according to the Skill metadata. 4. Homebrew executes attacker-controlled installation logic or installs the modified `runapi` executable. 5. The Skill invokes the compromised executable for authentication checks, request submission, local media handling, and result retrieval. 6. The executable can perform arbitrary actions within the privileges of the user running th ...[truncated 604 chars]
• Remediation: ## Remediation Suggestions - Pin the CLI to a reviewed, explicit version rather than accepting the latest formula revision. - Where supported, pin the tap or source repository to an immutable commit. - Require verification of a vendor-provided cryptographic signature or published checksum before execution. - Prefer an official, authenticated distribution channel with reproducible release artifacts. - Document the expected package version and fail closed if the installed version differs. - Periodically review the pinned version and update it through a controlled security review process. - Run the CLI with the minimum required operating-system privileges and isolate it from unrelated sensitive files and credentials.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:79
• Finding: Unrestricted Retrieval of Service-Controlled Deliverable URLs## Vulnerability Details **File Location**: `SKILL.md`, lines 79–84 **Vulnerability Type**: Insufficient URL and redirect validation during remote media retrieval **Risk Level**: Medium ### Vulnerable Code ```shell curl --fail --location <deliverable-url> --output <downloaded-file> for file in <downloaded-files>; do expected_mime=<expected-MIME-or-family-pattern-for-this-file> test -s "$file" [[ "$(file --brief --mime-type "$file")" == $expected_mime ]] done ``` ### Technical Analysis The Skill instructs the Agent to download URLs obtained from the service response using `curl --location`. Redirect following is enabled, but the instructions do not require validation of the original URL or each redirect target. In particular, there are no controls requiring HTTPS, restricting destinations to documented media-delivery domains, rejecting loopback or private-network addresses, or limiting response size and transfer duration. MIME-type and non-empty-file validation occur only after the network request and file write have completed. Those checks therefore cannot prevent an unwanted request from reaching an internal or otherwise unauthorized endpoint. If an API response, provider integration, or redirect endpoint is compromised or malformed, the supplied URL could direct the Agent to an unexpected external host or to a network service reachable only from the Agent's environment. This creates a server-side request forgery–style request primitive. The response is also saved locally, although the subsequent MIME check may reject it as a valid deliverable. ### Attack Path 1. An attacker compromises or manipulates a service response, delivery endpoint, or redirect in the deliverable retrieval chain. 2. The response contains a deliverable URL pointing directly to an unauthorized destination or to an attacker-controlled redirector. 3. The Agent invokes `curl` with `--location`. 4. `curl` follows ...[truncated 1240 chars]
• Remediation: ## Remediation Suggestions - Require the initial deliverable URL to use HTTPS. - Allowlist the documented RunAPI and media-delivery hostnames. - Validate every redirect target rather than only the original URL. - Resolve destination hostnames and reject loopback, link-local, private, reserved, multicast, and cloud-metadata address ranges for both IPv4 and IPv6. - Revalidate the destination after every DNS resolution and redirect to reduce DNS-rebinding risk. - Apply strict connection, transfer-time, redirect-count, and maximum-download-size limits. - Download into a newly created, permission-restricted temporary directory using non-user-controlled filenames. - Avoid overwriting existing files and reject symbolic-link destinations. - Preserve the existing non-empty-file and MIME-family checks, but treat them as post-download integrity checks rather than URL security controls. - Fail closed and report an invalid deliverable when any URL or redirect violates these restrictions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.