Security audit

JMCAI Comfypet

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for running JMCAI Comfypet workflows, but remote bridge mode can automatically transfer local media/files and follow bridge-supplied download URLs with insufficient guardrails.

Review before installing if you plan to use a LAN or remote bridge. Only point bridge_url at an endpoint you control and trust, prefer HTTPS off-device, avoid sending sensitive audio/video/images/PDFs unless you intend to transfer them, and be aware that outputs may be downloaded automatically to a temp directory.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: jmcai_skill.py:632
Finding: Workflow assets may be uploaded to remote bridges over unencrypted HTTP
Content: View full analysis
str: if path.startswith("http://") or path.startswith("https://"): return path return f"{str(config['bridge_url']).rstrip('/')}{path}" ``` The example configuration uses HTTP: ```json { "bridge_url": "http://localhost:32100" } ``` ### Technical Analysis The remote-bridge feature reads caller-selected workflow assets and serializes their complete contents using Base64 before sending them to `POST /api/v1/uploads`. Base64 is an encoding and provides no encryption, integrity protection, or authentication. Using HTTP is reasonable for a strictly loopback-only bridge, but the Skill explicitly supports configuring `bridge_url` to point to another machine on the LAN. The implementation does not distinguish between loopback HTTP and remote HTTP and does not reject or warn about an unencrypted remote endpoint. Consequently, images, masks, audio, video, text, CSV, PDF, and subtitle files may be transmitted in cleartext. Asset upload is necessary for the declared remote workflow functionality and is not evidence of a covert exfiltration mechanism. Uploads are restricted to absolute paths explicitly supplied as bridge-declared asset fields, and extension allowlists reduce arbitrary-file access. Nevertheless, allowing those assets to cross a non-loopba ...[truncated 1390 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: jmcai_skill.py:710
Finding: Bridge-controlled output URLs enable arbitrary HTTP requests from the Agent host
Content: View full analysis
str: if path.startswith("http://") or path.startswith("https://"): return path return f"{str(config['bridge_url']).rstrip('/')}{path}" ``` The resulting request is executed with the standard URL opener: ```python with urllib.request.urlopen(request, timeout=timeout_seconds) as response: headers = {key.lower(): value for key, value in response.headers.items()} return response.read(), headers ``` ### Technical Analysis The documented bridge contract describes `download_path` as a bridge-relative output download path. The implementation instead treats any value beginning with `http://` or `https://` as a complete, trusted destination. For successful remote runs, `status` and `history` automatically process these bridge-controlled values. A malicious or compromised bridge can therefore instruct the Agent host to make HTTP requests to arbitrary external or internal addresses. This includes ...[truncated 2229 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill description is broad enough to trigger on many generic image/video generation requests, which can cause over-invocation of a tool that executes local Python commands and may transfer local assets to a bridge service. In this context, the risk is not direct code execution from the prompt, but unintended activation of a powerful local workflow runner with file-handling and remote-bridge capabilities when a narrower tool or no tool should have been used.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill enables implicit invocation without any stated activation constraints, exclusions, or narrow trigger conditions. Because this skill can query workflows and submit image/video generation jobs to a locally configured desktop bridge, automatic invocation increases the chance of unintended execution, accidental asset processing, or surprise access to local workflow capabilities based only on loosely matched user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The code base64-encodes local files and POSTs them to /api/v1/uploads whenever a workflow schema marks a field as an asset and the provided argument looks like an absolute path. Although extension allowlists reduce abuse and loopback mode skips preprocessing, a non-loopback bridge can receive local user files without any explicit user-facing confirmation or disclosure at upload time, creating a data exfiltration/privacy risk if the bridge URL is remote or compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document explicitly states that in remote bridge mode the skill will upload local assets to a remote endpoint and automatically download outputs back to the current machine, but it does not require an explicit user-facing warning or consent step before those transfers occur. In a skill that handles local images, video, audio, masks, and files, this can cause unintended exfiltration of sensitive local data and unexpected writes to the analyst's machine, especially if users assume processing remains local to the desktop app.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs users to provide local absolute file paths and states that, when using a remote bridge, the skill will automatically upload those files. Because there is no explicit warning, confirmation step, or clear disclosure that local assets are transmitted off-host, users may unintentionally send sensitive images or files to a remote system, creating a real privacy and data-exposure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section broadens the same behavior to audio, video, file, and mask inputs, again stating that local absolute paths will be automatically uploaded and rewritten for remote execution. These asset types commonly contain sensitive personal, biometric, or proprietary data, so silent transmission to a remote bridge materially increases confidentiality and privacy risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.