40Medium
The skill executes unpinned, unverified packages via npx, creating a significant supply chain risk by allowing arbitrary, potentially malicious code to run in the agent's environment.
Skill Info
Nameagentspace-so/runcomfy-agent-skills/seedance-v2
Registrygithub
Versionfca19ae084c2
PURLpkg:github/agentspace-so/runcomfy-agent-skills@fca19ae084c2?skill=seedance-v2
Stars22
Installs261,700
Source
Install
This skill has findings worth reviewing before installing.
GitHub
260,300 installs
Skills.shDocs
npx skills add https://github.com/agentspace-so/runcomfy-agent-skillsAssessments (2)
AI Agent Traps ↗Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtimemediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtime
100% confidenceline 25
npx skills
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinningmediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning
100% confidenceline 46
npm i -g
Missing or insufficient descriptioninfopolicy violation
Skill description is empty or too short. A clear description helps users evaluate the skill's purpose.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/agentspace-so/runcomfy-agent-skills/seedance-v2)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/agentspace-so/runcomfy-agent-skills/seedance-v2"><img src="https://mondoo.com/ai-agent-security/api/badge/github/agentspace-so/runcomfy-agent-skills/seedance-v2.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/agentspace-so/runcomfy-agent-skills/seedance-v2.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow