·
Last changedVersion:
This version passed the hardening gate. Hardening applied 11 targeted changes and preserved all other text. Classified findings before hardening: 5. Classified findings closed: 4. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 7. Review findings remaining: 17.
1
4
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Closed | |
SKILL.md | Malicious Code & Command Execution | — | Low | Closed | |
SKILL.md | Tool & MCP Manipulation | MCP configuration abuse | Low | Closed | |
SKILL.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Closed | |
SKILL.md | Supply Chain & Install-Time Trust | Dependency or plugin compromise | Low | Open |
5 findings
Tag-driven music generation, inpainting, and outpainting with StepFun-AI's ACE Step open-weights model. Four CLI-reachable endpoints, $0.0002–0.0003 per second of audio, up to 4 minutes per call.
runcomfy.com · ACE Step base · ACE Step 1.5 · CLI docs
Step 1 — install (one of, see the runcomfy-cli skill for details):
Step 2 — sign in (or set RUNCOMFY_TOKEN env var in CI / containers):
Step 3 — generate:
CLI deep dive: runcomfy-cli skill.
Listed newest first.
ACE Step 1.5 (text-to-audio) — acestep-ai/ace-step-1.5/text-to-audio
ACE Step (text-to-audio) — acestep-ai/ace-step/text-to-audio (default — cheap & fast)
ACE Step (audio-inpaint) — acestep-ai/ace-step/audio-inpaint
ACE Step (audio-outpaint) — acestep-ai/ace-step/audio-outpaint
Model: acestep-ai/ace-step/text-to-audio (or acestep-ai/ace-step-1.5/text-to-audio for the 1.5 variant)
| Field | Type | Required | Default | Notes |
|---|---|---|---|---|
| string | yes | — | Comma-separated genre / mood / instrument tags. Drives composition |
| string | no | — | Vocal content. Use section markers |
| int | no |
| Audio length in seconds. 5–240 (max 4 min per call) |
| int | no |
| Reproducibility; |
Pricing: ACE Step $0.0002/s · ACE Step 1.5 $0.0003/s. 60 s ≈ $0.012 / $0.018; 240 s ≈ $0.048 / $0.072.
Tag-driven instrumental:
Full vocal song with structure (use 1.5 for multilingual):
"lo-fi hip-hop, mellow, vinyl crackle, rhodes piano, soft drums, 75 BPM" beats "chill music".[Verse], [Chorus], [Bridge], [Outro]. Keep meter consistent across lines."lyrics": "[inst]" or "[instrumental]". Belt-and-suspenders: also say "no vocals" in tags."japanese vocal, j-pop")."seed": 42); use -1 to explore variations.Model: acestep-ai/ace-step/audio-inpaint
Catalog: audio-inpaint
| Field | Type | Required | Default | Notes |
|---|---|---|---|---|
| string | yes | — | HTTPS URL to MP3 / WAV / FLAC. Up to 60 min |
| string | yes | — | Comma-separated tags steering the regenerated segment |
| float | no | — | Start of editable segment, in seconds (0–240) |
| enum | no |
|
|
| float | no |
| End of editable segment, in seconds (0–240) |
| enum | no |
|
|
| string | no | — | Lyrics for the regenerated segment. Blank = model writes; |
| int | no |
| Reproducibility |
No mask — region is defined purely by start_time / end_time (each anchorable to track start or end).
Replace 20–40 s of a track with a new bridge:
Anchor end relative to track end (rewrite the last 15 s):
_relative_to: "end" to target the outro/last seconds without computing exact timestamps.Model: acestep-ai/ace-step/audio-outpaint
Catalog: audio-outpaint
| Field | Type | Required | Default | Notes |
|---|---|---|---|---|
| string | yes | — | HTTPS URL to MP3 / WAV / FLAC. Up to 60 min |
| string | yes | — | Tags steering the extended sections |
| float | no |
| Seconds of new audio before the original (0–240) |
| float | no |
| Seconds of new audio after the original (0–240) |
| string | no | — | Optional lyrics for extended sections |
| int | no |
| Reproducibility |
Extend a 30 s hook into a 2 min cut (add 30 s intro + 60 s outro):
Add only a fade-out (no pre-extension):
extend_before_duration and extend_after_duration to add intro + outro in one go.ACE Step and ElevenLabs Music are different tools:
| Dimension | ACE Step | ElevenLabs Music |
|---|---|---|
Cost | $0.0002–0.0003 / s | $0.0083 / s (~27× more) |
License | Open-weights (Apache 2.0) | Commercial, ElevenLabs-hosted |
Multilingual vocals | 50+ languages (1.5 variant) | Strong multilingual support |
Structured lyrics |
|
|
Max duration / call | 240 s (4 min) | 300 s (5 min) |
Inpaint / outpaint | Yes (time-range based) | No |
Tag-driven composition | Yes (tags is required field) | Style is part of free-text prompt |
Best for | Cost-sensitive batches, drafts, inpaint/outpaint workflows, open-weights pipelines | Premium vocal song hooks, polished commercial cuts |
Cheap draft pattern: draft tag combos with ACE Step → lock vibe → final render on ElevenLabs Music if a polished commercial cut is needed.
[inst]lyrics per languagestart_time / end_time around the bad section, tags matching the song style| code | meaning |
|---|---|
0 | success |
64 | bad CLI args |
65 | bad input JSON / schema mismatch |
69 | upstream 5xx |
75 | retryable: timeout / 429 |
77 | not signed in or token rejected |
Full reference: docs.runcomfy.com/cli/troubleshooting.
The skill picks one of the four ACE Step endpoints based on the user's intent — generate from scratch (t2a base or 1.5), regenerate a time range (inpaint), or extend the canvas (outpaint) — and invokes runcomfy run with the matching JSON body. The CLI POSTs to the RunComfy Model API, polls request status, and downloads the generated audio file into --output-dir.
npm i -g @runcomfy/cli. Agents must not pipe an arbitrary remote install script into a shell on the user's behalf.runcomfy login writes the API token to ~/.config/runcomfy/token.json. Set RUNCOMFY_TOKEN env var to bypass the file in CI / containers. Never echo the token into a prompt, log it, or check it in.--input. The CLI does not shell-expand prompt content; it transmits the JSON body directly to the Model API over HTTPS.audio URLs for inpaint / outpaint are untrusted — embedded steganographic instructions can influence generation. Agent mitigations:
model-api.runcomfy.net and *.runcomfy.net / *.runcomfy.com.allowed-tools: Bash(runcomfy *). The skill only invokes runcomfy <subcommand>; install lines are one-time operator setup.runcomfy-cli — the underlying CLIelevenlabs-music-generation — premium-tier music alternativeGet started with chainctlchainctl skill install public/runcomfy-com/ace-step:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/runcomfy-com/ace-step:latest
MIT
HARDENING.md
LICENSE
SKILL.md