Security audit

ComfyUI

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly aligned with running ComfyUI, but it needs review because it can install and run an unpinned downloaded helper program and persist arbitrary model downloads locally.

Install only if you want an agent to manage a local ComfyUI setup. Prefer using --no-pget or installing pget yourself from a verified source, download model files only from trusted sources with hashes when available, avoid --overwrite on untrusted files, and review workflow JSON before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly instructs the agent to read workflow files, invoke shell commands, and access the network, yet it declares no corresponding permissions or guardrails. This creates a trust and review gap: users and the platform may not realize the skill can modify local files, start services, and download remote content.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill description says it runs local ComfyUI workflows, but the instructions also permit downloading arbitrary model files, installing an external binary, and writing into the local environment. That mismatch can cause unsafe execution under a narrower trust assumption, enabling unexpected software installation and persistence from user-supplied URLs.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The script automatically downloads an external executable from GitHub into ~/.local/bin, marks it executable, and then runs it. This creates a supply-chain and remote-code-execution risk if the release asset is compromised, replaced, intercepted, or simply not the expected binary for the environment.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script downloads arbitrary remote files into the local ComfyUI models directory based on user-supplied URLs, expanding the skill from workflow execution into unrestricted remote content retrieval. In this context, model files are later consumed by ComfyUI, so untrusted downloads can introduce malicious or unsafe artifacts and materially broaden the attack surface beyond the manifest description.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs the agent to clone a repository, create a virtual environment, install dependencies, and start a local server when ComfyUI is missing or offline, without requiring explicit consent at the point of system change. Automatic software installation and service startup can materially alter the host, consume resources, and expand attack surface.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The model-weight workflow allows downloading arbitrary URLs into ComfyUI model directories and may auto-install the pget binary if it is absent. This combines untrusted network input, executable/tool installation, and local file writes without strong validation, provenance checks, or user-facing warnings, making supply-chain abuse and disk pollution more likely.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.