T09 · Insecure Skill Coding Practices
Error
- Location
scripts/comfy_gen.py:103- Finding
Arbitrary File Overwrite via Server-Controlled Filename Path Traversal
- Content
View full analysis
- Remediation
View remediation
Security audit
ComfyUI Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill’s image-generation purpose is coherent, but a server-controlled filename can cause local files to be written outside the intended image folder.
Use this only with a trusted local ComfyUI server and non-sensitive prompts/workflows. Before installation, the publisher should harden downloads by generating or sanitizing local filenames, verifying the resolved output path stays inside the intended directory, and documenting that prompts/workflows are sent to the configured server and images are saved locally.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill documents capabilities that read local workflow files and communicate over the network to a ComfyUI server, but it does not declare any explicit tool scope or permissions. This creates a transparency and policy gap: users and the platform cannot clearly constrain or review the skill's access, increasing the risk of unintended file access or network interactions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill encourages sending prompts and workflow JSON to a locally hosted ComfyUI server over HTTP/WebSocket on the local network, but it does not clearly warn users that this data leaves the agent boundary and may traverse the network unencrypted. Prompts, embedded secrets, internal paths, or workflow contents could be exposed to other local-network observers or logged by the ComfyUI service.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script sends the user's prompt and full workflow JSON to whatever server address is provided, but it provides no validation, trust boundary checks, or user-facing disclosure about that transmission. In this skill's context, prompts may contain sensitive/private creative material and the workflow can reveal local model usage or custom processing details, so silent transmission to a network-accessible service is a genuine privacy/security concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script downloads content from the server and writes it directly to disk using a filename fully controlled by the remote ComfyUI response. Because filename is interpolated into image-gens/{filename} without sanitization, a malicious or compromised server could supply path traversal values and cause files to be written outside the intended directory, beyond the general undisclosed-download concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The negative prompt text includes the phrases "flat chest" and "huge breasts" as undesirable traits. Even though this is a workflow JSON file, these natural-language values can reflect problematic content guidance by treating specific body characteristics as negative attributes.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The workflow writes output files via a SaveImage node using the filename prefix "ZIT-UP/_", but this JSON file contains no nearby comment, description, or other user-facing disclosure that images will be persisted to disk. For code/config workflows, file-write behavior can merit an explicit warning unless clearly documented elsewhere.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow includes a SaveImage node that writes generated images to disk using the prefix "ZIT-UP/_", but the file itself provides no user-facing disclosure that local files will be created. In a local image-generation skill this behavior is expected, but undisclosed persistence can still surprise users and may expose sensitive or private generated content to other local users, backups, or sync tools.
- Content
Static analysis
No suspicious patterns detected.