Security audit

Genor-Comfy-Gate

Security checks for vulnerabilities and agentic risk

Overview

This is a real ComfyUI gateway, but it exposes broad agent-accessible admin, media, and file-handling powers that need review before installation.

Install only if you intend to run a persistent local ComfyUI gateway and can keep it private. Set a non-empty API key, bind it to localhost or a trusted network, treat generated media links as long-lived bearer URLs rather than one-time links, and review or disable the MCP restart, media resource, raw generation, and workflow upload features before exposing the gateway to any other user or agent.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The MCP handler exposes a `restart` tool that directly triggers `pm2 restart genor-comfy-gate`, giving any caller with MCP access an administrative control unrelated to normal workflow generation. In this context, MCP tools are intended for LLM-facing discovery and generation, so exposing process-management operations materially increases the attack surface and enables denial of service or disruption of active jobs.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: This is a real vulnerability: `/media-link-once` creates a token described and named as one-time, but `/media-once/:token` never deletes the token after a successful read. Anyone who obtains the URL can reuse it repeatedly until expiry, which breaks the security assumption of single-use access and can unintentionally expose protected media for far longer than expected. The risk is increased here because the default TTL is effectively one year, so a leaked link remains reusable for an extended period.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: `getAggregatedHistory` pulls history from every configured server and merges the results without any access control, tenant scoping, or filtering visible in this file. If exposed to untrusted users, it can reveal prompts, outputs, workflow metadata, or filenames across all backends, increasing cross-user data exposure and broadening the blast radius beyond a single server.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: `proxyView` forwards attacker-controlled `filename`, `subfolder`, and `type` parameters to upstream `/view` endpoints across all servers until one responds successfully. Without authorization checks or allowlisting, this can let a caller enumerate or retrieve other users' generated media or server-side files exposed by the upstream API, especially because the proxy tries every configured backend.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The restart handler executes a disruptive administrative action immediately with no confirmation, warning, or secondary authorization check. In an LLM-accessible MCP environment, this makes accidental or malicious invocation far more likely and can interrupt service availability, terminate in-flight generations, and create an easy denial-of-service primitive.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib/mcp-handler.js:606