ComfyUI汉服写真提示词模板

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:12 AM UTC
• Version: 1.0.0

Overview

This is a Chinese ComfyUI prompt-template skill with a disclosed external package install and some overstated documentation, but no evidence of hidden or malicious behavior in the reviewed files.

Install only if you are comfortable using a Chinese-language ComfyUI prompt pack and trusting the external comfy-batch package. Prefer installing it in an isolated virtual environment or container, and pin or verify the package version before running the documented commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25
• Finding: Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md:25` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```text - `pip install comfy-batch` ``` ### Technical Analysis The skill instructs users to install `comfy-batch` from the Python Package Index without specifying an exact version, verifying cryptographic hashes, or using a reviewed lockfile. The installed package is then imported and executed by the documented workflow. Because package installation and execution occur with the user's privileges, a compromised or unexpectedly changed release could execute arbitrary installation hooks or runtime code. The referenced GitHub repository does not cryptographically bind the reviewed source to the package artifact retrieved by `pip`. No evidence establishes that the current dependency is malicious. The risk arises from the mutable, unverified supply-chain boundary. ### Attack Path 1. An attacker compromises, replaces, or gains publishing access to the `comfy-batch` distribution. 2. A user follows the skill instructions and runs `pip install comfy-batch`. 3. `pip` retrieves the attacker-controlled release without a version or hash constraint. 4. Malicious installation logic may execute during installation. 5. The user subsequently imports `ZImage` from the package, causing attacker-controlled runtime code to execute. ### Impact Assessment Successful exploitation would provide code execution under the account running `pip` or the documented Python workflow. The accessible scope could include files, environment variables, credentials, and local services available to that account, including the local ComfyUI environment. The repository itself contains no privilege-escalation mechanism, so obtained privileges would ordinarily remain limited to those of the invoking user.
• Remediation: ## Remediation Suggestions - Pin the dependency to a reviewed exact version rather than installing the latest available release. - Supply a lockfile or requirements file containing cryptographic hashes and require hash verification during installation. - Verify the package publisher and ensure the published artifact corresponds to reviewed source at a specific signed tag or commit. - Perform installation and execution inside a dedicated virtual environment or container with minimal filesystem and network permissions. - Document the expected package origin, version, and integrity digest. - Periodically audit dependency ownership, releases, transitive dependencies, and installation hooks.

T08 · Insecure Dependencies

Warning

• Location: README.md:40
• Finding: Unpinned Dependency Executed as a Python Module## Vulnerability Details **File Location**: `README.md:40-41` **Vulnerability Type**: Unverified third-party package installation followed by execution **Risk Level**: Medium ### Vulnerable Code ```bash pip install comfy-batch python -m comfy_batch "your prompt" --double ``` ### Technical Analysis The documented command sequence installs an unconstrained package from the default pip index and immediately executes it as a Python module. There is no exact version, package hash, signature verification, reviewed dependency lockfile, or isolation requirement. This creates a direct supply-chain execution path: whatever artifact the package index resolves at installation time becomes executable code. A malicious installation hook may run during installation, while malicious module-level or command-line code may run through `python -m comfy_batch`. No malicious behavior was identified in the supplied project files, and the external package was not part of the reviewed artifact. This finding concerns the unsafe dependency acquisition and execution procedure. ### Attack Path 1. An attacker publishes or causes pip to resolve a compromised `comfy-batch` release. 2. A user copies and runs the documented installation command. 3. The unverified package and its dependencies are installed, potentially running installation-time code. 4. The user runs `python -m comfy_batch`. 5. Attacker-controlled module code executes with the user's permissions and can access resources available to the Python process. ### Impact Assessment Exploitation could result in arbitrary code execution with the invoking user's privileges. Potentially exposed resources include user-readable files, environment variables, local credentials, generated images, and reachable local services. The effective scope depends on the permissions and network access of the environment where the commands are run. No evidence in the audited project demonstrates administrator-level escalation or persistence.
• Remediation: ## Remediation Suggestions - Replace the unconstrained installation command with an exact reviewed version and verified hashes. - Use a hash-locked dependency file, for example with pip's hash-checking mode. - Bind the dependency to a reviewed and preferably signed release or immutable commit. - Install the package in an isolated virtual environment or restricted container under a non-privileged account. - Review installation metadata, entry points, build configuration, and transitive dependencies before recommending execution. - Avoid presenting installation and immediate execution as a single trusted workflow unless artifact integrity has been established.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code is largely aligned with the general theme of providing prompt templates for Hanfu portraits, Wong Kar-wai-style images, and magazine covers. However, the declared description materially overstates what is present. The file only contains static prompt strings and simple indexes/groupings. It does not include 14 templates as claimed, but 12. It also does not implement or expose any dual-sampler workflow, direct high-quality generation pipeline, ComfyUI nodes/integration, or hardware-specific support. Therefore the description does not accurately represent the full actual behavior of the supplied code chunk.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The README is entirely in Chinese and does not indicate that other languages are supported or that the Chinese-only presentation is an intentional, justified regional constraint. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill’s natural-language interface, including its description and example trigger phrases, is entirely in Chinese and offers no language choice or opt-in. Under the stated policy, forcing a specific language without giving the user a choice is a locale/language policy concern.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation section says the skill activates whenever the user needs any of several generic requests like “生成王家卫风格的图”, “做一张杂志封面”, or “帮我生成一张汉服写真.” These are broad, common prompts for image generation and the file does not provide scope limits, exclusion conditions, or negative examples to clarify when this specific skill should or should not activate.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This Python file includes natural-language descriptions and comments primarily in Chinese, such as the module docstring and category labels, but does not indicate that the skill is China-specific or that users can opt into this language. Under the language/locale policy, forcing a specific language without user choice can be a policy violation.

Static analysis

No suspicious patterns detected.