happyhorse-1-0

Pass

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the @runcomfy/cli package from the npm registry and provides instructions for adding the skill using npx from a public repository.- [COMMAND_EXECUTION]: The skill functions by executing the runcomfy CLI tool to send requests to the HappyHorse model API and manage the downloading of generated video files to a specified output directory.- [CREDENTIALS_UNSAFE]: The documentation describes how to manage the RUNCOMFY_TOKEN environment variable and explains that the CLI stores authentication tokens in ~/.config/runcomfy/token.json. No hardcoded credentials or unauthorized exfiltration of these tokens were detected.- [DATA_EXFILTRATION]: The skill performs network operations to model-api.runcomfy.net and runcomfy.com for model inference and result retrieval. These operations are limited to the service's official domains and are necessary for the skill's functionality.- [PROMPT_INJECTION]: The skill contains guidance on effective prompting strategies for text-to-video generation but does not include any instructions designed to bypass agent constraints or safety guidelines.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 30, 2026, 06:41 AM