·
Last changedVersion:
This version passed the hardening gate. Hardening applied 18 targeted changes and preserved all other text. Classified findings before hardening: 1. Classified findings closed: 1. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 16. Review findings remaining: 0.
1
None
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Closed |
1 finding
runcomfy.com · Text-to-video
Wan-AI's Wan 2.7 — flagship video model with audio-driven lip-sync — hosted on the RunComfy Model API.
| You want | Use |
|---|---|
Lip-sync video to an audio track you supply | Wan 2.7 ( |
Smooth transitions, accurate motion physics | Wan 2.7 |
Currently-#1 blind-vote video model | HappyHorse 1.0 |
Multi-modal cinematic with image+video+audio refs + in-pass voice generation | Seedance 2.0 Pro |
Cinematic motion editing on existing footage | Kling Video O1 |
Ultra-fast iteration | LTX 2 |
Route here only when the user explicitly asks to generate a video with Wan 2.7. A bare mention of "wan" in an unrelated context, such as networking, is not a request for this skill. Each run is a paid, credentialed API call: before every run, including retries after exit code 75, confirm the prompt, duration, resolution and expected cost with the user.
npm i -g @runcomfy/cli (this install is unpinned; run it only after the user confirms, and suggest the user pin and verify an exact release)runcomfy login opens a browser device-code flow. Run it only after the user confirms.RUNCOMFY_TOKEN=<token> instead of runcomfy login.runcomfy run and runcomfy login commands plus the user-confirmed install above.wan-ai/wan-2-7/text-to-video| Field | Type | Required | Default | Notes |
|---|---|---|---|---|
| string | yes | — | Up to ~5000 chars / ~1500 tokens. |
| string | no | — | WAV/MP3, 3–30s, ≤15MB. Drives lip-sync. Omit → background music auto-generated. |
| enum | no |
|
|
| enum | no |
|
|
| enum | no |
| 2–15 (whole seconds). |
| string | no | — | Up to 500 chars. Concrete issues to avoid. |
| bool | no | true | Auto-rewrites short prompts. Disable for literal control. |
| int | no | — | 0..2^31-1. Reuse for variants. |
The text-to-video endpoint accepts only the fields listed above.
audio_url rules: accept only public https links the user explicitly supplies. Ask the user before passing internal or private network addresses, or signed links that carry credentials. Before using audio_url, confirm the user has rights and consent for the voice audio and for any depicted likeness; refuse to impersonate real people who have not consented, and recommend labeling outputs as generated by AI. Audio longer than 15 seconds cannot match the maximum clip length, so suggest trimming it to the clip duration.
Rules for all examples below:
prompt or negative_prompt. Values in angle brackets are placeholders for replacement.aspect_ratio one of the five listed values, resolution 720p or 1080p, duration a whole number from 2 to 15, seed within its documented range, and audio_url per the rules above.--output-dir, by default use a new dedicated subdirectory inside the current workspace. Keep outputs out of system and home configuration folders, keep existing files intact, and ask the user before using any other location. Tell the user where the files were saved.Default (5s 1080p 16:9, prompt-expanded):
Audio-driven lip-sync (your own track):
Literal control (no auto-expansion):
Camera + motion in plain English. "Slow dolly in", "locked tripod, low angle", "handheld follow", "crane move from above". Front-load the shot.
One primary action per clip. Don't pile up multiple competing actions. Pick the beat: "she turns, then smiles" not "she turns AND smiles AND a bus passes AND...".
Use negative_prompt for concrete issues. Good: "no subtitles, no watermark, no flicker". Bad (vague): "no bad lighting".
Prompt expansion is on by default. Short prompts get auto-rewritten by the model. For terse / literal prompts (e.g. brand-strict ad copy), disable with enable_prompt_expansion: false.
Audio specs matter. audio_url must be 3–30s, ≤15MB, WAV/MP3. Out-of-range files reject. Match audio length to clip duration.
Iterate seeds. Reuse the same seed when you want consistent output across variants of the same prompt. Change seed for genuine variety.
Anti-patterns:
| Use case | Why Wan 2.7 |
|---|---|
Lip-synced ads with custom voiceover |
|
Multi-language dub variants | Same prompt, different |
Smooth transitions + motion physics | Strong physics-aware motion priors |
Negative-prompted clean output | Targeted issue exclusion |
Page example (product showcase):
Lip-synced spokesperson (with audio_url):
Vertical platform-native:
| code | meaning |
|---|---|
0 | success |
64 | bad CLI args |
65 | bad input JSON / schema mismatch |
69 | upstream 5xx |
75 | retryable: timeout / 429 |
77 | not signed in or token rejected |
Full reference: the RunComfy CLI troubleshooting docs.
The skill invokes runcomfy run wan-ai/wan-2-7/text-to-video with a JSON body matching the schema. The CLI POSTs to https://model-api.runcomfy.net/v1/models/wan-ai/wan-2-7/text-to-video, polls the request, fetches the result, and downloads any .runcomfy.net/.runcomfy.com URL into --output-dir. Per the vendor, Ctrl-C cancels the remote request before exit. Check that each downloaded file is a video of plausible size, and open downloaded files only as media.
Prompts and audio are sent to RunComfy, and prompt expansion rewrites short prompts by default. Ask the user before sending confidential or personal data, or audio of people who have not consented. Set enable_prompt_expansion to false when exact wording matters.
runcomfy login writes the API token to ~/.config/runcomfy/token.json with mode 0600 (owner-only read/write). Set RUNCOMFY_TOKEN env var to bypass the file entirely in CI / containers.--input. The CLI itself does not shell-expand the prompt, but the shell that runs the command does parse it, so the prompt must be encoded with a JSON encoder and fully shell-escaped as described in How to invoke.audio_url rules above.model-api.runcomfy.net (request submission) and *.runcomfy.net / *.runcomfy.com (download whitelist for generated outputs). The vendor states there is no telemetry and no callbacks; treat this as unverified when making safety decisions.Get started with chainctlchainctl skill install public/runcomfy-com/wan-2-7:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/runcomfy-com/wan-2-7:latest
MIT
HARDENING.md
LICENSE
SKILL.md