T09 · Insecure Skill Coding Practices
Error
- Location
comfy_client.py:59- Finding
Server-Controlled Filename Allows Arbitrary File Overwrite Through Path Traversal
- Content
View full analysis
- Remediation
View remediation
Security audit
Comfyui Handler
Security checks for vulnerabilities and agentic risk
Overview
This ComfyUI skill is coherent for image generation, but it gives a configured remote service too much influence over local file writes and transfers media over unauthenticated HTTP.
Install only if you trust the ComfyUI host and network path. Avoid sending sensitive images, keep the host local or behind a trusted encrypted/authenticated channel, and treat generated downloads as untrusted until the filename/path handling is fixed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
comfy_client.py:29- Finding
Images, Prompts, and Generated Results Are Transmitted Over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
comfy_client.py:42- Finding
Unbounded HTTP Operations and Infinite Polling Permit Resource Exhaustion
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
README.md:21- Finding
Unpinned Python Dependency Installation Prevents Reproducible Supply-Chain Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly advertises automatic upload of input images to a remote ComfyUI host and automatic download/write of generated outputs to the local workspace, but it does not clearly warn users about the data-transfer and local write implications. This can lead users or downstream agents to transmit sensitive files off-host or overwrite/store artifacts locally without informed consent, which is especially risky in an agent skill designed for automated execution.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill reads host and port values from a workspace-level TOOLS.md file and then blindly trusts them to construct the service URL. This creates a cross-workspace trust boundary issue: if TOOLS.md is modified by another component or attacker, the client can be redirected to an unintended local or remote endpoint, causing data exfiltration or interaction with an attacker-controlled service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The upload function sends the contents of a user-supplied local file to the configured ComfyUI endpoint without any in-file disclosure, confirmation, or verification that the endpoint is trustworthy. Because the endpoint can also be influenced by external configuration, this can expose local media files to an attacker-controlled service and leak sensitive data.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The client downloads arbitrary content from the service and writes it into the local outputs directory using a server-influenced filename. While the intent appears to be normal result saving, writing unvalidated remote content to disk can lead to storage abuse, misleading files, or path issues if filenames are not normalized and constrained.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This workflow embeds a long natural-language prompt that combines English and Chinese content in a fixed way. Because the file provides no indication that language selection is user-configurable or intentionally region-specific, it can conflict with language/locale choice expectations under the policy.
- Content