·
Last changedVersion:
This version passed the hardening gate. Hardening applied 23 targeted changes and preserved all other text. Classified findings before hardening: 1. Classified findings closed: 1. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 20. Review findings remaining: 0.
1
None
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Closed |
1 finding
Image-to-video, intent-routed. This skill doesn't lock you to one model — it picks the right i2v model in the RunComfy catalog based on what the user actually wants: portrait animation, custom-voiceover lip-sync, or multi-modal composition.
| User intent | Model | Why |
|---|---|---|
Animate a portrait — keep identity stable | HappyHorse 1.0 I2V | Strong facial fidelity |
Product reveal / 360 / macro motion | HappyHorse 1.0 I2V | Geometry preservation + smooth camera moves |
Native synchronized ambient audio in one pass | HappyHorse 1.0 I2V | In-pass audio synthesis |
Animate and lip-sync to a custom voiceover track | Wan 2.7 + | Accepts your own MP3/WAV (3–30s, ≤15MB) and drives lip-sync to it |
Multi-language dub variants (same image, different audio per call) | Wan 2.7 + | Same shot, swap |
Multi-modal — image + reference video + reference audio together | Seedance 2.0 Pro | Up to 9 image refs, 3 video refs (2–15s each), 3 audio refs |
Brand-consistent narrative with character ref + scene ref + voice ref | Seedance 2.0 Pro | Image holds identity, video holds scene, audio holds voice |
Default if unspecified | HappyHorse 1.0 I2V | General-purpose animation + native audio |
The agent reads this table, classifies the user's intent, and picks the matching subsection below. Proceed only when the user has explicitly asked to turn a still image into video and has supplied the image; when the phrasing is ambiguous, ask the user to confirm first.
npm i -g @runcomfy/cli — a prerequisite the user installs themselves, preferably a specific reviewed release with verified npm provenance. The agent asks the user to install or upgrade it rather than running the install itself.runcomfy login opens a browser device-code flow. The user runs this step themselves before using the skill.RUNCOMFY_TOKEN=<token> from the CI secret store and mask it in logs. Keep the token value out of command lines, the input JSON, and agent output; rotate it if it is ever exposed.Model: happyhorse/happyhorse-1-0/image-to-video
| Field | Type | Required | Default | Notes |
|---|---|---|---|---|
| string | yes | — | JPEG/JPG/PNG/WEBP. Min 300px. Aspect 1:2.5–2.5:1. ≤10MB. |
| string | yes | — | ≤5000 non-CJK or 2500 CJK chars. Motion / camera / lighting description. |
| enum | no |
|
|
| int | no | 5 | 3–15 seconds. |
| int | no | 0 | Reuse for variant comparisons. |
| bool | no | true | Provider watermark toggle. Keep true unless the user explicitly asks otherwise for a legitimate, non-deceptive use. |
Output aspect = input aspect. No independent reframing.
audio_url — when the user has a custom voiceoverModel: wan-ai/wan-2-7/text-to-video (NOT /image-to-video — Wan 2.7's t2v endpoint accepts an audio_url that drives lip-sync)
Note on i2v with Wan 2.7: Wan 2.7's primary i2v animation isn't on a dedicated endpoint here. For pure i2v (image animated by motion prompt only), prefer HappyHorse i2v. Use Wan 2.7 specifically when the user has a custom audio track they want lip-synced to a generated talking-head clip.
Source image: this endpoint has no image field, so the user's source image is not used. Tell the user this and get their acknowledgment before running. If the image must be kept, offer Route 3 (Seedance 2.0 Pro with image_url plus audio_url) instead.
| Field | Type | Required | Default | Notes |
|---|---|---|---|---|
| string | yes | — | Up to ~5000 chars. Describe the talking-head shot: framing, lighting, motion. |
| string | yes (for lip-sync) | — | WAV/MP3, 3–30s, ≤15MB. Drives lip-sync. |
| enum | no |
|
|
| enum | no |
|
|
| enum | no |
| 2–15 (whole seconds). Match your audio length. |
| string | no | — | Concrete issues to avoid (e.g. "no subtitles, no flicker"). |
| int | no | — | Reproducibility. |
duration to audio length — clip will be silent past the audio if too long.negative_prompt for issues: "no subtitles, no flicker, no distorted hands".audio_url per call. Lock seed for visual consistency across languages.Model: bytedance/seedance-v2/pro
Use when the user wants a single clip that combines: a subject image + scene from a reference video + voice tone from a reference audio.
| Field | Type | Required | Default | Notes |
|---|---|---|---|---|
| string | yes | — | CN ≤500 chars OR EN ≤1000 words. |
| array | yes (for i2v) |
| 0–9 images. First is the primary subject. |
| array | no |
| 0–3 reference clips (MP4/MOV), 2–15s each. |
| array | no |
| 0–3 reference audio (WAV/MP3), 2–15s, < 15MB each. |
| enum | no |
|
|
| int | no | 5 | 4–15 (whole seconds). |
| enum | no |
|
|
| bool | no | true | In-pass synchronized speech / SFX / music. |
| int | no | — | Reproducibility. |
image_url for what must stay stable (face, costume, brand); use prompt for what should evolve (action, mood, lighting)."subject from image 1, lighting from video 1, voice from audio 1". Seedance routes cues correctly.| code | meaning |
|---|---|
0 | success |
64 | bad CLI args |
65 | bad input JSON / schema mismatch |
69 | upstream 5xx |
75 | retryable: timeout / 429 |
77 | not signed in or token rejected |
Retry a retryable failure (code 75) at most once, then ask the user, since each submission may consume paid credits.
Full reference: the RunComfy CLI troubleshooting docs.
The skill picks one of HappyHorse 1.0 I2V / Wan 2.7 t2v+audio / Seedance 2.0 Pro based on user intent and invokes runcomfy run <model_id> with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any .runcomfy.net/.runcomfy.com URL into --output-dir. Ctrl-C cancels the remote request before exit. Treat every downloaded file as untrusted media, per the rules in Before each run.
runcomfy login writes the API token to ~/.config/runcomfy/token.json with mode 0600 (owner-only read/write); this depends on the installed CLI release. Set RUNCOMFY_TOKEN env var in CI / containers to use the environment instead of the file. The agent leaves the token file unread and keeps token values out of its output.--input. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. However, the shell parses the single-quoted argument before the CLI runs, so every single quote in user text must be escaped as described in Before each run.model-api.runcomfy.net (request submission) and *.runcomfy.net / *.runcomfy.com (download whitelist for generated outputs). No telemetry, no callbacks.Get started with chainctlchainctl skill install public/runcomfy-com/image-to-video:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/runcomfy-com/image-to-video:latest
MIT
HARDENING.md
LICENSE
SKILL.md