Security audit
Security checks for vulnerabilities and agentic risk
This is a small ComfyUI image-generation skill that discloses sending prompts to a local endpoint and shows no hidden execution, persistence, or exfiltration behavior.
Install only if you intend to use a local ComfyUI instance at 127.0.0.1:8188. Avoid putting secrets or sensitive personal data in image prompts, since the local ComfyUI service may save outputs or keep logs. Non-Chinese readers may need translation because the skill documentation is Chinese-only.
The visible natural-language instructions and descriptions are entirely in Chinese, which can impose a language constraint on users without opt-in. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified.
The skill explicitly states it sends user prompts to a local ComfyUI HTTP endpoint, but it does not warn users that their input will be transmitted off the agent into another service. Even though the endpoint is localhost, prompts may contain sensitive data and the receiving service may log, persist, or further process that content without the user's awareness.
