happyhorse-1-0
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
runcomfycommand-line interface to submit video generation tasks. This is a standard integration method for local tools and is used to communicate with the Model API. - [EXTERNAL_DOWNLOADS]: The skill documentation guides the user to install the
@runcomfy/clidependency from the NPM registry. This package is an official tool for the supported service. - [INDIRECT_PROMPT_INJECTION]: The skill handles user-provided text prompts by interpolating them into a JSON structure before passing them to the execution command.
- Ingestion points: User prompt input in
SKILL.md. - Boundary markers: The skill uses JSON stringification to isolate the user prompt within the CLI arguments.
- Capability inventory: The skill is capable of executing the
runcomfyCLI tool. - Sanitization: The skill documentation specifies that the CLI transmits the JSON payload directly to the API without shell expansion, reducing the risk of command injection.
Audit Metadata