ClawHub
Back to skill

Security audit

ComfyUI 多重扩散放大

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent ComfyUI workflow helper, but it tells users to install unspecified ComfyUI nodes and models from unverified sources, which deserves review before use.

Review the required ComfyUI nodes and models before installing. Prefer pinned repositories, known publishers, checksums, and isolated/non-admin ComfyUI environments; do not click install for arbitrary missing nodes or similarly named models without verifying their source.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
references/faq.md:43
Finding

Unverified Installation of ComfyUI Custom Nodes

Content
View full analysis

Vulnerability Details

File Location: references/faq.md, lines 43-47
Vulnerability Type: Unverified third-party executable dependency installation
Risk Level: Medium

Vulnerable Documentation Snippet

markdown
## Q: The generated workflow cannot be imported into ComfyUI?

**A:** This script generates a simplified workflow:
1. Open ComfyUI.
2. Click "Load" and select the JSON file.
3. The system will report missing nodes; click to install the missing nodes.
4. Alternatively, manually install the missing custom nodes through Manager.

Technical Analysis

The documentation instructs users to install unspecified missing custom nodes through ComfyUI Manager. It does not identify the required repositories, trusted publishers, immutable revisions, or expected integrity hashes.

ComfyUI custom nodes are executable Python components rather than passive configuration files. A package selected from an unverified search result can execute code with the same operating-system privileges as the ComfyUI process. Name collisions, repository compromise, malicious search results, or dependency substitution could therefore turn the recommended installation process into a supply-chain attack.

The project does not itself download or execute remote content. The risk arises when a user follows the documented installation procedure.

Attack Path

  1. An attacker publishes a malicious custom-node repository under a name matching or resembling a node reported as missing.
  2. The user imports the generated workflow and receives a missing-node notification.
  3. Following the documentation, the user accepts the suggested installation or searches ComfyUI Manager without verifying the repository owner and revision.
  4. ComfyUI Manager downloads and installs the attacker-controlled Python package.
  5. ComfyUI imports or initializes the custom node.
  6. The malicious initialization code executes with the privileges of th ...[truncated 636 chars]
Remediation
View remediation

Remediation Suggestions

  1. List every required custom node using its exact repository URL and verified publisher.
  2. Pin each dependency to an immutable commit hash or signed release rather than a branch or search result.
  3. Publish SHA-256 hashes or signatures for approved release artifacts.
  4. Warn users not to install arbitrary packages merely because their names resemble missing node types.
  5. Recommend reviewing custom-node source code and installation scripts before use.
  6. Maintain an explicit allowlist of compatible repositories and versions.
  7. Recommend running ComfyUI under a dedicated, non-administrative account or isolated environment.
  8. If the workflow can operate with built-in nodes, remove unnecessary custom-node installation instructions.

T08 · Insecure Dependencies

Warning
Location
references/models.md:66
Finding

Unpinned Models from Unverified Search-Based Sources

Content
View full analysis

Vulnerability Details

File Location: references/models.md, lines 66-76
Vulnerability Type: Unverified third-party model dependency acquisition
Risk Level: Medium

Vulnerable Documentation Snippet

markdown
## Model Downloads

### Automatic download through ComfyUI Manager

1. Open ComfyUI and select Manager.
2. Search for the model name.
3. Click Install.

### Manual download

Recommended download sources:
- Hugging Face: https://huggingface.co/FacehugmanIII/4x_faces_Sharp_Better_higher_quality
- CivitAI: https://civitai.com/models
- OpenModelDB: https://openmodeldb.info/

Technical Analysis

The documentation recommends locating models by name through ComfyUI Manager or broad third-party model indexes. It supplies no immutable artifact versions, checksums, digital signatures, or verification procedure.

Several recommended upscale models use the .pth extension. Depending on the ComfyUI model loader and underlying framework version, PyTorch-compatible files may involve unsafe object deserialization. A malicious or replaced model artifact could consequently carry executable serialized content. Even when a loader uses a restricted loading mode, an unverified model can still cause denial of service, malformed output, excessive resource consumption, or other parser-specific behavior.

The presence of a repository URL alone does not establish artifact integrity. Repository compromise, malicious re-uploading, similarly named models, or a changed Manager index entry could cause a user to retrieve an artifact different from the one originally intended.

Attack Path

  1. An attacker uploads a malicious model with a matching or deceptively similar filename, compromises a listed source, or influences a Manager search result.
  2. A user follows the documentation and installs the model based only on its displayed name.
  3. The model is placed in the ComfyUI model directory.
  4. The generated ...[truncated 885 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin each model to an exact artifact URL and immutable release or repository revision.
  2. Publish and require verification of SHA-256 hashes before models are loaded.
  3. Prefer non-executable formats such as safetensors where compatible.
  4. Avoid recommending generic name-based searches as the primary installation method.
  5. Document the expected publisher, repository, filename, file size, and checksum for every approved model.
  6. Require a current loader configuration that uses restricted weight-only loading for PyTorch-compatible artifacts.
  7. Run model loading in a least-privileged, isolated environment with limited filesystem and credential access.
  8. Treat changes to approved model artifacts or hashes as security-sensitive updates requiring review.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill instructs users to run local scripts that generate workflow files, which implies file-write capability, but the manifest does not declare any tool scope or permissions. Undeclared capabilities weaken least-privilege controls and can cause the agent platform or reviewers to underestimate what the skill can do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description says the skill should be used when a user wants to enlarge AI-generated images, process HD images, enlarge small images, or improve image resolution. These triggers are broad, everyday image-editing intents and the file does not provide narrower trigger phrases, scope limits, or exclusion examples, which could cause unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The natural-language content of the skill file consistently assumes Chinese as the interaction language, including the title, description, and usage instructions. There is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The FAQ is entirely written in Chinese, starting with the title at L01 and continuing throughout the file, with no indication that another language is available or that Chinese-only output is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code file contains natural-language instructions and status messages that force a specific language for all users. The policy allows locale constraints only when they are justified or when the user is given a language/locale choice, neither of which is present here.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/check_env.py (reported line 170)May include surrounding context.

python
for mod in required:
        try:
            __import__(mod)
            print(f"   ✅ {mod}")
        except ImportError:
            print(f"   ❌ {mod} 未安装")

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest says the skill supports both 文生图 and 图生图 base workflows, but this code only builds an upscale pipeline around text-conditioning nodes and lacks any image-loading/encoding path for an input image. There is no LoadImage, VAEEncode, or equivalent node wiring that would make an actual image-to-image base workflow possible.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file presents all guidance in Chinese and does not offer an alternative language or state that the skill is intended only for Chinese-speaking users. Under the policy rule for language/locale, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file is entirely written in Chinese and does not indicate that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The stated purpose emphasizes automated upscaling for user images and workflow auto-construction, yet this script merely serializes a predefined workflow JSON to disk. It does not ingest source images, validate model availability, connect optional workflow variants, or trigger ComfyUI execution, so the implemented behavior is narrower than the description suggests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.