image

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:57 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent ComfyUI purpose, but its downloader can automatically install and run an unverified binary and can fetch/write user-supplied URLs too broadly.

Review before installing. Use this only in an isolated local account or environment, prefer --no-pget, download models only from trusted HTTPS sources with known checksums, and avoid pasting arbitrary model URLs. Check where files will be written under ~/ComfyUI/models before allowing overwrite behavior.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/download_weights.py:118

Finding

Encoded URL components allow arbitrary filesystem writes outside the model directory

Content

View full analysis

`. The unsafe path is used both in the generated `pget` manifest and by the built-in downloader. ### Attack Path 1. An attacker provides a purported model URL containing encoded separators or traversal sequences in its final path component. 2. `resolve_url_dest()` splits the URL before decoding the filename. 3. `unquote()` transforms the comp ...[truncated 962 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/download_weights.py:108

Finding

Unrestricted URL fetching enables server-side request forgery and local-resource access

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/download_weights.py:65

Finding

Mutable third-party executable is automatically downloaded and executed without integrity verification

Content

View full analysis

str | None: """Return path to pget binary, or None if not found and install failed.""" pget = shutil.which("pget") if pget: return pget # Install to ~/.local/bin local_bin = os.path.expanduser("~/.local/bin") pget_path = os.path.join(local_bin, "pget") if os.path.isfile(pget_path) and os.access(pget_path, os.X_OK): return pget_path os.makedirs(local_bin, exist_ok=True) sysname = platform.system() machine = platform.machine() if machine == "aarch64": machine = "arm64" elif machine == "x86_64": machine = "x86_64" # Replicate releases: pget_Linux_x86_64, pget_Darwin_arm64, etc. asset = f"pget_{sysname}_{machine}" url = f"{PGET_RELEASE}/{asset}" try: req = urllib.request.Request(url, headers={"User-Agent": "ComfyUI-Skill/1.0"}) with urllib.request.urlopen(req, timeout=60) as resp: with open(pget_path, "wb") as f: f.write(resp.read()) os.chmod(pget_path, 0o755) return pget_path except Exception as e: print(f"Could not install pget ({e}); falling back to built-in download.", file=sys.stderr) return None ``` The downloaded binary is then executed: ```python def download_with_pget(manifest_path: str, pget_bin: str, overwrite: bool) -> bool: cmd = [pget_bin, "multifile", manifest_path] i ...[truncated 2513 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 48)May include surrounding context.

md

## Updating the Skill

- When ComfyUI's API or workflow format changes, update SKILL.md and the run script.
- Keep the "If the server isn't reachable" section in sync with current ComfyUI install/run instructions.
- Bump version when publishing a new release to SkillBoss Hub.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/download_weights.py (reported line 173)May include surrounding context.

python

ap.add_argument(
        "--overwrite",
        action="store_true",
        help="Overwrite existing files",
    )
    ap.add_argument(
        "--no-pget",

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill's activation cues are broad enough that it could trigger on generic image-generation or workflow-related requests, causing the agent to invoke local tooling, inspect files, or prepare workflow execution when the user may not have intended to use this specific skill. In this context, over-broad activation is more dangerous because the skill can lead to network downloads, local file writes, and service startup on the host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The skill instructs writing modified workflows to a persistent temp path within the skill assets directory, which can leave user-derived prompts, seeds, or workflow data on disk across sessions. In context this is less severe than arbitrary code execution, but it still creates avoidable cross-session persistence and potential leakage of prior user inputs or generated configuration.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

2. **Identify prompt-related nodes** by inspecting the graph: look for nodes that hold the main text prompt — e.g. `PrimitiveStringMultiline`, `CLIPTextEncode` (positive text), or any node with `_meta.title` or `class_type` suggesting "Prompt" / "positive" / "text". Update the corresponding input (e.g. `inputs.value`, or the text input to the encoder) to the image prompt you derived from the user (subject, style, lighting, quality). If the user didn't ask for a custom image, you can leave the existing prompt or tweak only if needed.
3. **Optionally identify style/prefix nodes** — e.g. `StringConcatenate`, or a second string input that acts as style. Set them if the user asked for a specific style or to clear a default prefix.
4. **Optionally set a new seed** — find sampler-like nodes (e.g. `KSampler`, `BasicGuider`, or any node with a `seed` input) and set `seed` to a new random integer so each run can differ.
5. Write the modified workflow to a temp file (e.g. `skills/comfyui/assets/tmp-workflow.json`). Use `~/ComfyUI/venv/bin/python` for any inline Python; do not use bare `python`.
6. Run: `comfyui_run.py --workflow <path-to-edited-json>`.

If the workflow structure is unclear or you can't find prompt/sampler nodes, run the file as-is and only change what you can reliably identify. Same approach for arbitrary user-supplied JSON: inspect first, edit at your best knowledge, then run.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs the agent to download arbitrary model-weight URLs and write them under ~/ComfyUI/models/ without an explicit safety/consent step covering network access, disk writes, storage size, provenance, or trust of the downloaded artifacts. This is risky because user-supplied URLs can cause unexpected filesystem changes and fetch untrusted content that may later be loaded by ComfyUI or related components.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download_weights.py (reported line 127)May include surrounding context.

python

cmd = [pget_bin, "multifile", manifest_path]
    if overwrite:
        cmd.append("-f")
    r = subprocess.run(cmd)
    return r.returncode == 0

Static analysis

No suspicious patterns detected.