ClawHub
Back to skill

Security audit

Comfy Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for ComfyUI management, but it under-warns users about network exposure, third-party code installation, and token/model-download risks.

Install only if you are comfortable with a skill that can guide agents to install and update executable ComfyUI components, alter an existing workspace, store model-provider tokens, and expose a ComfyUI server on the network. Prefer pinned versions, review custom nodes and workflow dependencies before installing them, avoid putting tokens directly in shared logs or command history, and do not use 0.0.0.0 unless you have explicit network controls in place.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:4
Finding

Unpinned Dependencies and Untrusted Custom Node Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:4, SKILL.md:12-15, SKILL.md:67-75, and SKILL.md:88-90
Vulnerability Type: Uncontrolled third-party dependency installation
Risk Level: High

Complete Code Snippets:

yaml
metadata: {"clawdbot":{"emoji":"🎨","requires":{"bins":["comfy"]},"install":[{"id":"uv","kind":"uv","package":"comfy-cli","bins":["comfy"],"label":"Install comfy-cli (uv)"}]}}
bash
comfy install
comfy launch
comfy node install ComfyUI-Impact-Pack
comfy model download --url "https://civitai.com/api/download/models/12345"
bash
comfy node install <name>
comfy node install <name> --fast-deps
comfy node reinstall <name>
comfy node uninstall <name>
comfy node update all
comfy node disable <name>
comfy node enable <name>
comfy node fix <name>
bash
comfy node bisect
comfy node deps-in-workflow workflow.json
comfy node install-deps --workflow workflow.json

Technical Analysis

The skill declares comfy-cli without a fixed version, package hash, signature, or immutable source reference. It also directs users or agents to install and update custom nodes from a registry and to install dependencies inferred from externally supplied workflow files.

ComfyUI custom nodes and Python dependencies can contain executable Python code. Consequently, installing an unreviewed node, resolving an unpinned package, updating all nodes, or processing a malicious workflow dependency declaration can introduce code that executes with the privileges of the user running comfy.

The document does not require registry allowlisting, version pinning, commit verification, integrity validation, package review, or sandboxing. This creates a supply-chain execution path in which the effective code may change after the skill itself has been audited.

Attack Path

  1. An attacker publishes or compromises a package, cu ...[truncated 1338 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin comfy-cli to a reviewed version rather than installing the latest available release.
  • Require cryptographic hashes, signed releases, or immutable commit identifiers for packages and custom nodes.
  • Restrict installation to an explicit allowlist of trusted registries, publishers, repositories, and versions.
  • Do not automatically install dependencies extracted from untrusted workflow files. Display and review the complete dependency set before installation.
  • Replace unrestricted comfy node update all guidance with controlled, individually reviewed updates.
  • Inspect custom-node source code and dependency manifests before installation.
  • Perform installation and execution in a dedicated, unprivileged account or isolated container with minimal filesystem and network access.
  • Maintain lock files or reviewed snapshots and verify their integrity before restoration.
  • Add an explicit warning that custom nodes are executable code rather than passive assets.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:45
Finding

Potential Unauthenticated ComfyUI Exposure on All Network Interfaces

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:45-50
Vulnerability Type: Unsafe network service configuration
Risk Level: Medium

Complete Code Snippet:

bash
comfy launch                           # Foreground mode
comfy launch --background              # Background mode
comfy launch -- --listen 0.0.0.0       # Pass args to ComfyUI
comfy stop                             # Stop background instance
comfy launch --frontend-pr 1234        # Test frontend PR

Technical Analysis

The documented command passes --listen 0.0.0.0 to ComfyUI, causing the service to bind to every available IPv4 network interface rather than only the loopback interface. The skill provides this example without accompanying requirements for authentication, authorization, TLS, firewall filtering, reverse-proxy controls, or a warning about network exposure.

Binding to all interfaces does not by itself prove that the service is externally reachable: reachability also depends on firewall, routing, container, and host configuration. However, on a permissive host or network, this configuration can expose the ComfyUI endpoint to other local-network or internet users. The severity increases if the deployed ComfyUI instance lacks an independent authentication layer or contains custom nodes that expose sensitive operations.

Attack Path

  1. A user follows the documented example and launches ComfyUI with --listen 0.0.0.0.
  2. The host firewall, cloud security group, router, or container port mapping permits access to the ComfyUI port.
  3. An attacker discovers the exposed service through local-network enumeration, internet scanning, or knowledge of the host address.
  4. If no separate authentication and authorization control is configured, the attacker connects directly to the ComfyUI interface or API.
  5. The attacker interacts with exposed workflows, queues jobs, consumes host resources, or invokes functionality made available ...[truncated 649 chars]
Remediation
View remediation

Remediation Suggestions

  • Use the loopback interface by default and omit --listen 0.0.0.0 unless remote access is explicitly required.
  • Add a prominent warning that binding to 0.0.0.0 may expose ComfyUI to untrusted networks.
  • Place remotely accessible deployments behind an authenticated reverse proxy using TLS.
  • Restrict inbound access with host firewalls, cloud security groups, VPNs, or explicit source-address allowlists.
  • Do not expose the ComfyUI port directly to the public internet.
  • Run ComfyUI under a dedicated, unprivileged account with restricted access to sensitive files.
  • Review custom nodes before network exposure because they may add APIs or operations beyond the base application.
  • Document a verification step that checks the listening address, reachable interfaces, firewall rules, and authentication controls before launch.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The example comfy launch -- --listen 0.0.0.0 binds ComfyUI to all network interfaces, making the service reachable from other hosts, but the skill provides no warning about exposure. Because ComfyUI commonly provides workflow execution and file/model interaction capabilities, unintentionally exposing it can broaden attack surface and enable unauthorized access on local networks or beyond if port forwarding/firewall rules permit it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documents destructive state-changing commands such as uninstalling nodes, restoring snapshots/dependencies, and removing models without warning that they can alter or delete an existing ComfyUI setup. In an agent context, this increases the chance of unintended modification or loss of environment state because users may invoke these commands assuming they are routine and reversible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill encourages downloading models from arbitrary URLs and using CivitAI/Hugging Face access tokens but does not warn about untrusted content, provenance risks, or token handling. In a tool-installation and model-management skill, omission of these precautions can lead to users fetching unsafe artifacts or exposing sensitive credentials in command history, logs, or shared environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.