Security audit

Comfyskill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small ComfyUI image-generation helper whose local HTTP and workflow-file access match its stated purpose, with some disclosure and robustness gaps users should notice.

Install only if you intend to send prompts to a ComfyUI service. Check COMFYUI_ENDPOINT and WORKFLOW_PATH before use, avoid putting secrets or sensitive personal data in prompts, and be aware the current implementation appears brittle because it references a prompt variable and workflow file shape inconsistently.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares network-capable behavior by sending prompts to a local HTTP endpoint, but it does not define any explicit tool scope, permissions, or allowed-tools boundary. This creates an authorization and transparency gap: an agent may be able to make network requests or access environment-backed capabilities without the skill clearly constraining or documenting them.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: Natural-language policy violations include forcing a specific language without user opt-in. This file presents the skill name, description, commands, and settings headings in Chinese only, with no indication that users may choose another language or that the skill is intentionally region-specific.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This code posts the generated workflow JSON to a network endpoint, which can transmit user-provided prompt content and local workflow data off-process. The file provides no confirmation prompt, user-facing warning, or explanatory comment about this network transmission.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The function returns user-facing status messages only in Chinese, with no indication that the user can choose their preferred language or locale. This creates a natural-language policy concern because the skill imposes a specific language by default.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The skill states that user prompts are sent to a local ComfyUI service but does not warn users that their input will be transmitted over HTTP to another process. Even though the endpoint is localhost, prompts may still contain sensitive data, and forwarding them without disclosure reduces informed consent and can expose data to unintended local services or logs.

Missing User Warnings

Low

Confidence: 71% confidence
Finding: The function accesses environment configuration and reads a local file based on WORKFLOW_PATH, but the file contains no user-facing explanation or warning that local configuration and filesystem content will be accessed. For safety-sensitive skill auditing, this lacks visible disclosure of local file access behavior.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: index.js:5