🖼️ Image Outpainting — Pro Pack on RunComfy

PassAudited by ClawScan on May 14, 2026.

Overview

This instruction-only skill is coherent for RunComfy image outpainting, but users should notice it requires a RunComfy login/token and sends chosen image prompts/URLs to RunComfy through the CLI.

This appears safe for its stated purpose if you intend to use RunComfy. Before installing, verify the RunComfy CLI source, understand that prompts and image URLs are sent to RunComfy, and protect your RUNCOMFY_TOKEN like any account credential.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill may consume RunComfy account quota or credits and will act under the user's RunComfy account.

Why it was flagged

The skill requires a RunComfy CLI credential and local RunComfy configuration, giving it access to the user's RunComfy account for the requested image-generation task.

Skill content
clawdis:\n  requires:\n    bins:\n      - runcomfy\n    env:\n      - RUNCOMFY_TOKEN\n    config:\n      - ~/.config/runcomfy
Recommendation

Use a scoped RunComfy token where possible, keep it out of shared logs, and revoke it if no longer needed.

What this means

Installing a global npm CLI runs third-party code on the user's machine.

Why it was flagged

The setup guidance asks users to install or run an external npm CLI package. This is expected for a RunComfy CLI skill, but it is still third-party executable tooling.

Skill content
npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version
Recommendation

Install the CLI from the official RunComfy documentation/package source and keep it updated.

What this means

Selected image URLs and prompts are sent to RunComfy, and outputs are written locally.

Why it was flagged

The skill invokes an external model endpoint through the RunComfy CLI and writes results to a local output directory. This is aligned with outpainting, but users should understand what images and prompts are submitted.

Skill content
runcomfy run google/nano-banana-2/edit \\\n  --input '{"prompt": "...extend canvas...", "image_urls": ["..."]}' \\\n  --output-dir ./out
Recommendation

Only submit images you are comfortable processing with RunComfy, and choose an output directory you control.