happyhorse-1-0
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@runcomfy/clipackage from the npm registry and provides instructions for adding the skill usingnpxfrom a public repository.- [COMMAND_EXECUTION]: The skill functions by executing theruncomfyCLI tool to send requests to the HappyHorse model API and manage the downloading of generated video files to a specified output directory.- [CREDENTIALS_UNSAFE]: The documentation describes how to manage theRUNCOMFY_TOKENenvironment variable and explains that the CLI stores authentication tokens in~/.config/runcomfy/token.json. No hardcoded credentials or unauthorized exfiltration of these tokens were detected.- [DATA_EXFILTRATION]: The skill performs network operations tomodel-api.runcomfy.netandruncomfy.comfor model inference and result retrieval. These operations are limited to the service's official domains and are necessary for the skill's functionality.- [PROMPT_INJECTION]: The skill contains guidance on effective prompting strategies for text-to-video generation but does not include any instructions designed to bypass agent constraints or safety guidelines.
Audit Metadata