image
Security checks across malware telemetry and agentic risk
Overview
The skill's files, scripts, and runtime instructions are consistent with its stated purpose (running and managing local ComfyUI workflows), with only minor notes about local installs and downloads the user should be aware of.
This skill appears to do what it says: queue local ComfyUI workflows and download model weights. Before installing or running it, note that (1) the agent (or the helper scripts) will read and modify workflow JSON — always inspect workflows before running to avoid unexpected behavior; (2) the download script will fetch arbitrary URLs you (or a user) provide and save them into ~/ComfyUI/models/ — only download weights from trusted sources; (3) if pget is absent the script will download a pget binary from GitHub and place it in ~/.local/bin (review that file if you want to verify it); and (4) the skill writes files only under your home directory, not system-wide, and does not request credentials. Also be aware of the minor metadata inconsistency about required binaries (SKILL.md mentions python3). If you are comfortable with those local changes and trusting the sources for model weights, the skill is coherent with its stated purpose.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings