Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward RunningHub API guide, with expected third-party API use but no hidden execution, persistence, or local privilege behavior.
Install this only if you intend your agent to use RunningHub's cloud API. Prompts, workflow inputs, uploaded media if used, task identifiers, and your RunningHub API key may be sent to RunningHub endpoints, and some workflow runs may incur account charges. Keep API keys in a secure secret store and confirm before publishing or changing workflows.
The trigger list includes broad conditions such as '用户要求使用 ComfyUI 生成图片/视频' and '管理 RunningHub 工作流和应用' without clear boundaries, exclusions, or exact invocation phrases. This can cause the skill to activate for common creative or workflow-related requests that may not specifically intend to use RunningHub.
The skill includes concrete API examples that send user prompts and bearer-token authentication to third-party endpoints, but it does not explicitly warn that user content and credentials will leave the local system. In a skill context, this can lead to unintentional disclosure of sensitive prompts, media, or secrets if the agent uses the skill without clear consent and data-handling notice.
This example performs an outbound network request to a third-party API and includes an Authorization bearer token, creating a clear external transmission path for user-supplied prompts and credentials. In context, external transmission is the intended function of the integration, but it is still security-relevant because misuse or silent invocation could expose sensitive content or incur unauthorized charges.
// 执行文生图工作流
const response = await fetch('https://open.runninghub.cn/api/v1/run', {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_API_KEY',
The manifest description contains Chinese-language text ("云端 ComfyUI 平台") with no indication that the skill is intentionally region-specific or that users can choose a preferred language. This can violate language/locale policy expectations for skills unless the locale restriction is explicit and justified.
No suspicious patterns detected.