lowvram-ai-video-comfyui

• Outcome: Review
• Latest audit: Sep 25, 2026 · 10:00 PM UTC
• Version: 1.1.1

Overview

The skill is mostly a coherent ComfyUI setup guide, but it tells users to make a persistent global Git redirect through a third-party mirror without clear scoping or cleanup.

Review before installing. Only follow the setup steps if you intentionally want to modify a local ComfyUI/video-generation environment. Avoid the global ghfast.top Git redirect unless you fully trust that mirror; prefer direct GitHub access, a scoped proxy, a pinned verified commit, and remove any temporary global rewrite after use. Treat the NVIDIA driver and Torch/CUDA changes as system-level maintenance, not routine skill execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:69

Finding

Persistent global GitHub redirection through a third-party mirror

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:69-70
Additional Location: references/comfyui-install-troubleshooting.md:8
Vulnerability Type: Unsafe dependency source and persistent global Git configuration modification
Risk Level: Medium

Vulnerable snippet from SKILL.md:

sh

git config --global url."https://ghfast.top/https://github.com/".insteadOf "https://github.com/"
git pull --ff-only origin master

Equivalent instruction from references/comfyui-install-troubleshooting.md:

sh

git config --global url."https://ghfast.top/https://github.com/".insteadOf "https://github.com/"

Technical Analysis

The installation guidance persistently configures Git to replace every URL beginning with https://github.com/ with a URL routed through ghfast.top. Because the setting is applied with --global, it is not limited to the ComfyUI repository or the current installation process.

The subsequent git pull retrieves executable ComfyUI source through this intermediary. The user expects code from GitHub, but transport and content delivery are delegated to an unrelated mirror without an independently verified commit, signature, or digest. If the mirror is malicious or compromised, it can attempt to substitute repository content that will later execute under the user's account when ComfyUI starts.

This is a supply-chain vulnerability rather than evidence that the Skill author is deliberately distributing malware. The reviewed files do not establish that the mirror currently serves malicious content.

Attack Path

1. The user follows the Skill's deployment instructions.
2. Git receives a persistent global insteadOf rule redirecting GitHub URLs through ghfast.top.
3. The user runs the documented git pull, or later performs another Git operation against a GitHub URL.
4. A malicious or compromised mirror supplies altered repository objects or redirects retrieval to attac ...[truncated 890 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not install a global insteadOf rule for a third-party mirror. Prefer direct access to the canonical GitHub repository.
2. If network routing is necessary, use an explicitly trusted local or enterprise proxy that preserves TLS validation rather than rewriting the repository source.
3. If the mirror must be supported, scope its use to a single command or repository instead of using git config --global.
4. Pin the installation to a reviewed commit or signed release rather than pulling a mutable branch such as master.
5. Verify the selected commit, release signature, or cryptographic digest using metadata obtained independently from the mirror.
6. Remove any temporary rewrite immediately after use:

   sh

   git config --global --unset-all url."https://ghfast.top/https://github.com/".insteadOf
   

7. Update both SKILL.md and references/comfyui-install-troubleshooting.md so the unsafe instruction is not reintroduced through the secondary documentation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list includes broad, generic terms such as hardware constraints and model names that are likely to appear in ordinary conversation, not just explicit requests to invoke this skill. In an agent environment, that can cause overbroad auto-activation and unintended execution of the skill’s installation or operational guidance in contexts where the user only wanted discussion or comparison.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The usage condition says to use the skill when a user mentions running video models or handing off a local video production environment, which is too ambiguous and expansive for safe routing. This increases the chance that the agent applies the skill to broad or incidental requests, leading to unnecessary system changes, package installation, driver updates, or model downloads without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all operational instructions in Chinese, with no indication that the user can choose another language and no documented reason that the skill is region- or language-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.