🎨 AI Image Generation — Pro Pack on RunComfy

PassAudited by ClawScan on May 13, 2026.

Overview

This appears to be a straightforward RunComfy image-generation helper, but it uses RunComfy credentials and an external CLI/package to send generation requests to the service.

This skill looks purpose-aligned for RunComfy image generation. Before installing, confirm you trust the RunComfy CLI package, use an appropriate RunComfy token, and avoid sending sensitive prompts or images unless you are comfortable with them being processed by RunComfy.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user who follows the setup instructions will run a third-party CLI package on their machine.

Why it was flagged

The skill documents installing or executing the external RunComfy CLI package from npm, without a pinned version in the provided artifact.

Skill content

npm i -g @runcomfy/cli ... npx -y @runcomfy/cli --version

Recommendation

Install the CLI from the official RunComfy documentation, verify the package name, and keep it updated from a trusted source.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent can submit RunComfy jobs using the user's account and may consume credits or quota.

Why it was flagged

The skill requires RunComfy authentication, either via interactive login or a token. This is expected for using the provider but is still account-level authority.

Skill content

runcomfy login ... export RUNCOMFY_TOKEN=<token-from-runcomfy.com/profile>

Recommendation

Use a scoped or revocable RunComfy token where available, and review generation requests before running costly or sensitive jobs.

Note

ASI02: Tool Misuse and Exploitation

What this means

Prompts and generation inputs are sent to RunComfy, and output files are written locally.

Why it was flagged

The core workflow invokes the local RunComfy CLI with user-provided prompt input and writes generated outputs to a local directory. This matches the skill purpose.

Skill content

runcomfy run <vendor>/<model>/<endpoint> --input '{"prompt": "..."}' --output-dir ./out

Recommendation

Avoid submitting private or sensitive prompts/images unless you are comfortable with RunComfy processing them, and choose an output directory intentionally.