Comfy Skill

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: comfy-skill Version: 1.0.0 The skill bundle is a standard implementation for interacting with a local ComfyUI instance (127.0.0.1:8188) to generate images. The workflow.json contains a boilerplate Stable Diffusion 1.5 configuration, and SKILL.md defines a simple generate_image function that aligns with the stated purpose without any signs of malicious intent or prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Using the skill may submit prompts to your local ComfyUI instance and consume local CPU/GPU resources to generate images.

Why it was flagged

The skill directs the agent to send user prompts to a local ComfyUI endpoint using the provided workflow. This is purpose-aligned, but it does interact with a local service and can trigger image-generation work.

Skill content

`generate_image(prompt: string)`: 接收使用者的描述並發送到 ComfyUI。

- endpoint: http://127.0.0.1:8188
- workflow: workflow.json

Recommendation

Use it only if you intentionally run and trust ComfyUI at 127.0.0.1:8188, and review the workflow before submitting prompts.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

You have less external context for who maintains the skill or where it originated, although the provided artifacts are small and readable.

Why it was flagged

The skill has limited provenance information. There is no install script or executable code in the artifacts, so this is a transparency note rather than a material concern.

Skill content

Source: unknown
Homepage: none
Install specifications: No install spec — this is an instruction-only skill.

Recommendation

Review SKILL.md and workflow.json yourself before installing, especially because no source repository or homepage is provided.