Openclaw Comfyui Api Runner

Safe ComfyUI image generation. Use saved or ad-hoc server profiles, paste/upload raw workflow JSON, submit, poll, and serve downloaded outputs locally.

Security Scan

The skill's code, requirements, and instructions are coherent with a ComfyUI API runner; no hidden network endpoints or unrelated credentials are requested, but a couple of operational details (local server binding and on-disk storage of credentials) merit attention.

Purpose & Capability

Name/description match the implementation: the scripts submit ComfyUI workflows, poll results, download outputs, and optionally serve them. The declared primary credential (COMFYUI_API_KEY) is used as an Authorization header. Minor mismatch: SKILL.md says it 'serves downloaded outputs locally' but the HTTP viewer binds to 0.0.0.0, making the files reachable from the network/LAN rather than strictly localhost.

Instruction Scope

SKILL.md directs the agent to run the included comfy.sh entrypoint which runs the Python runner. The runtime instructions and code limit actions to reading/writing the skill folder, a small per-user config (~/.config/openclaw/comfyui-runner.json), and talking to the configured ComfyUI base_url. The instructions do not request unrelated system files or unrelated credentials.

Install Mechanism

There is no remote install step — all code is bundled and executed locally. No downloads from third-party URLs or archive extraction are used. The only runtime requirement is python3, as declared.

Credentials

Required/declared credential (COMFYUI_API_KEY) is appropriate for the stated purpose and is actually used. The skill also supports COMFYUI_USERNAME and COMFYUI_PASSWORD and will persist credentials in ~/.config/openclaw/comfyui-runner.json if you save a profile — storing secrets on disk (in clear JSON) may be undesirable for some users. No unrelated environment variables or external service keys are requested.

Persistence & Privilege

always:false and the skill does not attempt to modify other skills or global agent settings. It does persist user profiles and defaults to ~/.config/openclaw/comfyui-runner.json (normal for a CLI tool) and may spawn a short-lived HTTP server to serve generated/ files. The server auto-exits after a timeout but is started as a subprocess accessible while running.

Assessment

This skill appears to be what it says: a local ComfyUI workflow submitter and downloader. Before installing, consider: 1) The viewer server binds to 0.0.0.0 (not just localhost), so if you start the viewer its generated/ folder may be reachable from other machines on your network — set COMFYUI_SERVE_PORT and firewall rules or modify code to bind to 127.0.0.1 if you want it strictly local. 2) Saved profiles (including optional API key, username, password) are stored in plaintext JSON at ~/.config/openclaw/comfyui-runner.json — avoid saving secrets there if that is a concern and prefer supplying COMFYUI_API_KEY via ephemeral env at runtime. 3) The skill executes bundled Python scripts (no external downloads), so review the included files (already provided) if you need assurance. 4) Only point the runner at trusted ComfyUI instances — it will send workflow JSON and download images from the configured base_url. If you want me to, I can point out the exact lines that implement the viewer binding and config persistence so you can change them.

ComfyUI Safe Connector

Small safe runner for ComfyUI.

What it does

• Connects to a remembered server profile or ad-hoc connection settings
• Accepts a workflow as a pasted JSON string, uploaded file, stdin, or built-in template
• Submits the workflow to ComfyUI
• Polls until done and downloads all output images
• Saves images under generated/
• Returns downloaded file paths and browser view URLs for each output

Workflow keywords

Saved workflows can include keywords in their .meta.json. Use the keyword, not the prompt, to pick the right template.

Examples:

• IL-Ikastrious → anime, cartoon, illustration, ikastrious
• use for anime/cartoon image requests

Main command

Run from the skill root:

./comfy.sh --health
./comfy.sh --list-profiles
./comfy.sh --save-profile home --base-url http://127.0.0.1 --port 8188
./comfy.sh --gen --workflow-file /path/to/workflow.json
./comfy.sh --gen --workflow-stdin < workflow.json
./comfy.sh --gen --workflow-json '{...json...}'
./comfy.sh --poll <prompt_id>
./comfy.sh --watch <prompt_id>

comfy.sh is the supported entrypoint (instead of calling the Python runner directly).

Server profiles

Profiles live in:

~/.config/openclaw/comfyui-runner.json

Supported fields:

• servers (list of server entries)
• base_url
• port
• api_key
• username
• password
• default_server
• default_workflow

Use:

• --profile NAME to use one for this run
• --save-profile NAME to remember the current connection
• --set-profile NAME to make a saved profile active
• --set-default-server NAME to set the default server
• --set-default-workflow NAME to set the default workflow
• --delete-profile NAME to remove one

Env vars override saved profiles:

• COMFYUI_PROFILE
• COMFYUI_BASE_URL
• COMFYUI_PORT
• COMFYUI_API_KEY
• COMFYUI_USERNAME
• COMFYUI_PASSWORD

Workflow input

Preferred for this skill:

• --workflow-file for uploaded JSON files
• --workflow-stdin for pasted JSON
• --workflow-json for direct JSON strings

Built-in templates still work via the positional template id, but raw JSON is the default safe path. If a keyword matches exactly one saved workflow, you can pass the keyword instead of the template id.

Output

• poll / watch write downloaded files to generated/
• return JSON includes view_url, local_path, and outputs[]
• image files can be sent directly into Discord or another channel if you want delivery there
• server profiles are remembered in ~/.config/openclaw/comfyui-runner.json

Safety

• No shell interpolation of workflow contents
• JSON is parsed, not executed
• API key support is optional
• Use only trusted ComfyUI servers