ComfyUI Local Gen

• Analyzed: May 12, 2026, 4:27 AM
• Findings: 0
• Version: 1.1.0
• Hash: 74ce8419c017f5322a6cd6098c11e209c0777cebe0e2b11a027273220e2ea4fc
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: comfyui-local Version: 1.1.0 The skill is classified as suspicious due to several vulnerabilities in `scripts/comfy_gen.py`. It allows for arbitrary JSON file reads via the `--workflow` argument, as the script does not restrict the path to within the skill directory. Additionally, the script saves images using filenames provided directly by the ComfyUI server, posing a potential path traversal vulnerability if a malicious server provides a crafted filename. While the core functionality is benign, these flaws could be exploited for local file access or arbitrary file writes.