Security audit
Comfy Cloud
Security checks across malware telemetry and agentic risk
Overview
This skill is a clearly disclosed connector for Comfy Cloud's hosted MCP service and does not contain hidden code or suspicious behavior.
Before installing, understand that this skill connects OpenClaw to Comfy Cloud, may send prompts and uploaded files to that service, may consume Comfy Cloud credits, and requires either OAuth login or an API key. Use OAuth when possible, keep API keys out of shared files, and only upload content you are comfortable processing through Comfy Cloud.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.