56 results available
Sign in
Skills directory

wan-2-7

runcomfy-com

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 18 targeted changes and preserved all other text. Classified findings before hardening: 1. Classified findings closed: 1. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 16. Review findings remaining: 0.


Open before hardening

1

Medium
Open after hardening

None


Expand
File
Group
Subtype
Severity
Status
SKILL.md

Supply Chain & Install-Time Trust

—

Medium
Closed

1 finding


SKILL.md

Wan 2.7 — Pro Pack on RunComfy

runcomfy.com · Text-to-video

Wan-AI's Wan 2.7 — flagship video model with audio-driven lip-sync — hosted on the RunComfy Model API.

When to pick this model (vs siblings)

You wantUse

Lip-sync video to an audio track you supply

Wan 2.7 (audio_url)

Smooth transitions, accurate motion physics

Wan 2.7

Currently-#1 blind-vote video model

HappyHorse 1.0

Multi-modal cinematic with image+video+audio refs + in-pass voice generation

Seedance 2.0 Pro

Cinematic motion editing on existing footage

Kling Video O1

Ultra-fast iteration

LTX 2

Route here only when the user explicitly asks to generate a video with Wan 2.7. A bare mention of "wan" in an unrelated context, such as networking, is not a request for this skill. Each run is a paid, credentialed API call: before every run, including retries after exit code 75, confirm the prompt, duration, resolution and expected cost with the user.

Prerequisites

  1. RunComfy CLI — npm i -g @runcomfy/cli (this install is unpinned; run it only after the user confirms, and suggest the user pin and verify an exact release)
  2. RunComfy account — runcomfy login opens a browser device-code flow. Run it only after the user confirms.
  3. CI / containers — set RUNCOMFY_TOKEN=<token> instead of runcomfy login.
  4. Token handling — keep the token out of commands, logs, transcripts and output; refer to it only by its variable name, and keep the token file contents private. In CI, supply the token from a secret store, prefer rotatable tokens, and rotate the token on suspected exposure.
  5. Shell scope — the skill only needs the documented runcomfy run and runcomfy login commands plus the user-confirmed install above.

Endpoints + input schema

wan-ai/wan-2-7/text-to-video

FieldTypeRequiredDefaultNotes

prompt

string

yes

—

Up to ~5000 chars / ~1500 tokens.

audio_url

string

no

—

WAV/MP3, 3–30s, ≤15MB. Drives lip-sync. Omit → background music auto-generated.

aspect_ratio

enum

no

16:9

16:9, 9:16, 1:1, 4:3, 3:4.

resolution

enum

no

1080p

720p or 1080p.

duration

enum

no

5

2–15 (whole seconds).

negative_prompt

string

no

—

Up to 500 chars. Concrete issues to avoid.

enable_prompt_expansion

bool

no

true

Auto-rewrites short prompts. Disable for literal control.

seed

int

no

—

0..2^31-1. Reuse for variants.

The text-to-video endpoint accepts only the fields listed above.

audio_url rules: accept only public https links the user explicitly supplies. Ask the user before passing internal or private network addresses, or signed links that carry credentials. Before using audio_url, confirm the user has rights and consent for the voice audio and for any depicted likeness; refuse to impersonate real people who have not consented, and recommend labeling outputs as generated by AI. Audio longer than 15 seconds cannot match the maximum clip length, so suggest trimming it to the clip duration.

How to invoke

Rules for all examples below:

  • Build the input body with a real JSON encoder so user text is always one escaped string value in prompt or negative_prompt. Values in angle brackets are placeholders for replacement.
  • The invoking shell parses the whole command, so the single-quoted argument must be fully shell-escaped. If the user text contains a single quote or another shell metacharacter, escape it properly or stop and report.
  • Set every other field only from validated parameters: aspect_ratio one of the five listed values, resolution 720p or 1080p, duration a whole number from 2 to 15, seed within its documented range, and audio_url per the rules above.
  • For --output-dir, by default use a new dedicated subdirectory inside the current workspace. Keep outputs out of system and home configuration folders, keep existing files intact, and ask the user before using any other location. Tell the user where the files were saved.

Default (5s 1080p 16:9, prompt-expanded):

runcomfy run wan-ai/wan-2-7/text-to-video \
  --input '{"prompt": "<user prompt>"}' \
  --output-dir <absolute/path>

Audio-driven lip-sync (your own track):

runcomfy run wan-ai/wan-2-7/text-to-video \
  --input '{
    "prompt": "Medium close-up of the spokesperson, warm key light, locked tripod, slight breathing motion.",
    "audio_url": "https://.../voiceover.mp3",
    "duration": 12,
    "aspect_ratio": "9:16"
  }' \
  --output-dir <absolute/path>

Literal control (no auto-expansion):

runcomfy run wan-ai/wan-2-7/text-to-video \
  --input '{
    "prompt": "<exactly what you want, verbatim>",
    "enable_prompt_expansion": false,
    "negative_prompt": "no subtitles, no flicker, no distorted hands"
  }' \
  --output-dir <absolute/path>

Prompting — what actually works

Camera + motion in plain English. "Slow dolly in", "locked tripod, low angle", "handheld follow", "crane move from above". Front-load the shot.

One primary action per clip. Don't pile up multiple competing actions. Pick the beat: "she turns, then smiles" not "she turns AND smiles AND a bus passes AND...".

Use negative_prompt for concrete issues. Good: "no subtitles, no watermark, no flicker". Bad (vague): "no bad lighting".

Prompt expansion is on by default. Short prompts get auto-rewritten by the model. For terse / literal prompts (e.g. brand-strict ad copy), disable with enable_prompt_expansion: false.

Audio specs matter. audio_url must be 3–30s, ≤15MB, WAV/MP3. Out-of-range files reject. Match audio length to clip duration.

Iterate seeds. Reuse the same seed when you want consistent output across variants of the same prompt. Change seed for genuine variety.

Anti-patterns:

  • Static-frame descriptions → motion will be vague.
  • Vague negatives ("no bad colors") → ignored.
  • Audio outside the 3–30s / 15MB / WAV-MP3 spec → rejected.
  • Prompts > 5000 chars / 1500 tokens → degraded output.

Where it shines

Use caseWhy Wan 2.7

Lip-synced ads with custom voiceover

audio_url accepts your track

Multi-language dub variants

Same prompt, different audio_url per language

Smooth transitions + motion physics

Strong physics-aware motion priors

Negative-prompted clean output

Targeted issue exclusion

Sample prompts

Page example (product showcase):

Cinematic medium shot of a product on a marble surface, soft studio
lighting, slow subtle camera push-in, shallow depth of field, premium
commercial look, crisp 1080p detail

Lip-synced spokesperson (with audio_url):

Medium close-up of a confident spokesperson in a softly-lit recording
booth, leaning slightly toward the camera, locked tripod, shallow depth
of field, warm key light from camera-left.

Vertical platform-native:

9:16 vertical short. A barista pulls a single espresso shot, steam
rising into morning sun, rich crema slowly forming. Close-up handheld,
shallow DOF, warm cafe ambience.

Limitations

  • Duration cap 15s. For longer narratives, stitch multiple calls.
  • No native 4K — 1080p ceiling.
  • Aspect ratios — only the 5 documented values.
  • Audio specs — 3–30s, ≤15MB, WAV/MP3 only.
  • For in-pass voice generation (no separate audio track), use Seedance 2.0 Pro — Wan accepts audio rather than generating it.

Exit codes

codemeaning

0

success

64

bad CLI args

65

bad input JSON / schema mismatch

69

upstream 5xx

75

retryable: timeout / 429

77

not signed in or token rejected

Full reference: the RunComfy CLI troubleshooting docs.

How it works

The skill invokes runcomfy run wan-ai/wan-2-7/text-to-video with a JSON body matching the schema. The CLI POSTs to https://model-api.runcomfy.net/v1/models/wan-ai/wan-2-7/text-to-video, polls the request, fetches the result, and downloads any .runcomfy.net/.runcomfy.com URL into --output-dir. Per the vendor, Ctrl-C cancels the remote request before exit. Check that each downloaded file is a video of plausible size, and open downloaded files only as media.

Prompts and audio are sent to RunComfy, and prompt expansion rewrites short prompts by default. Ask the user before sending confidential or personal data, or audio of people who have not consented. Set enable_prompt_expansion to false when exact wording matters.

Security & Privacy

  • Token storage (as stated by the vendor, not verified by this skill): runcomfy login writes the API token to ~/.config/runcomfy/token.json with mode 0600 (owner-only read/write). Set RUNCOMFY_TOKEN env var to bypass the file entirely in CI / containers.
  • Input boundary: the user prompt is passed as a JSON string to the CLI via --input. The CLI itself does not shell-expand the prompt, but the shell that runs the command does parse it, so the prompt must be encoded with a JSON encoder and fully shell-escaped as described in How to invoke.
  • Third-party content: audio URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted and follow the audio_url rules above.
  • Outbound endpoints (as stated by the vendor): only model-api.runcomfy.net (request submission) and *.runcomfy.net / *.runcomfy.com (download whitelist for generated outputs). The vendor states there is no telemetry and no callbacks; treat this as unverified when making safety decisions.
  • Generated-file size cap (as stated by the vendor): the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.

Install

Install with chainctl
chainctl skill install public/runcomfy-com/wan-2-7:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/runcomfy-com/skills
Upstream commitdb3fb49c83d2adf7a2b21b3146edbaf5f14a2a05
OCI reference

skills.cgr.dev/public/github.com/runcomfy-com/wan-2-7:latest

License

MIT

Files

HARDENING.md

LICENSE

SKILL.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.