ComfyUI图像生成

• Analyzed: Apr 3, 2026, 7:46 AM
• Findings: 1
• Version: 1.0.0
• Hash: 29a9df27d98ecf728e1ad8cf53265688a394d485f154dc450ca4a15a4fbca503
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a functional interface for ComfyUI image generation but contains high-risk path traversal vulnerabilities. The `generate` and `download_image` functions in `__init__.py` and `comfyui_generator.py` accept an `output_path` parameter and perform file write/copy operations without sanitization, potentially allowing an attacker to overwrite arbitrary system files. Additionally, the code contains hardcoded internal IP addresses (192.168.18.15) and specific mount paths (/mnt/share2win), which are characteristic of environment-specific internal tools but pose a risk if deployed in untrusted environments.