JMCAI Comfypet
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code and runtime instructions are consistent with its stated purpose (calling a local JMCAI Comfypet Workflow Bridge to list workflows, submit runs, upload media assets, and poll results), but it can upload local files to a remote bridge if configured — review the bridge_url and allowed file types before use.
This skill appears to do what it claims: it talks to a JMCAI Comfypet Workflow Bridge (default localhost), lists workflows, submits runs, and uploads/downloads media assets. Before installing: 1) Confirm the config.json bridge_url is local (127.0.0.1) unless you explicitly trust a remote bridge — pointing it at an untrusted host will cause the skill to upload your local files. 2) Note the skill enforces a whitelist of allowed extensions (images, common media, .txt/.pdf/.csv/subtitle formats) — avoid passing sensitive documents even if their suffix is allowed. 3) Run the provided doctor/registry commands to verify the desktop application and bridge version. 4) If you have concerns, review the jmcai_skill.py source (included) or test with non-sensitive files first. If you expect the skill to never transmit files over the network, do not change bridge_url to a remote host.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.