comfyui-agent-skill-mie

• Outcome: Review
• Latest audit: Oct 13, 2026 · 4:52 PM UTC
• Version: 1.0.5

Overview

The skill largely matches its ComfyUI workflow purpose, but it includes voice cloning without clear consent or anti-impersonation guardrails.

Install only if you intend to let an agent send prompts and user-selected media to a local or trusted ComfyUI server and save generated outputs locally. Use the voice-cloning workflow only with clear permission from the voice owner, and avoid saving server URLs that contain credentials or point to untrusted hosts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (88)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code’s actual purpose is narrowly focused: it takes a workflow JSON path, calls an analyzer, and writes a generated config template or config file to disk. That is related to workflow preparation/review, but it does not implement the main declared behavior of running registered ComfyUI workflows through a CLI, interacting with a ComfyUI server, checking health, preflighting dependencies, saving server URLs, or enforcing execution restrictions on registered workflows. Because the supplied code chunk’s primary behavior is materially different from the declared end-user description, this is a mismatch for this chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description emphasizes a constrained, policy-enforced workflow runner: only registered workflows and reviewed imports should execute, with extra management features like health checks, dependency preflight, private-registry import, and saving server URL. This code does not implement those restrictions or review gates. Instead, it exposes generic API methods that can post any provided workflow JSON directly to /prompt, upload files/media, inspect queue/history, and retrieve outputs. While some of this can be supporting functionality for a ComfyUI integration, the key behavioral mismatch is the absence of the declared safety boundary against executing arbitrary unreviewed workflow JSON. The code also lacks several specifically claimed capabilities, suggesting the implementation shown is a broader raw API client rather than the restricted stable CLI described.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code chunk is a generic workflow JSON manipulation utility, not a CLI runner or registry-gated execution layer. It can open any workflow file path provided to it, inspect and modify nodes, and write the result back out. That behavior is materially different from the declared purpose, which emphasizes safe execution of only registered/reviewed workflows on a trusted ComfyUI server and explicitly says it does not execute arbitrary unreviewed workflow JSON. While this snippet does not itself execute workflows, it does provide arbitrary workflow loading/editing functionality and lacks the declared controls and server-oriented features. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The description presents a workflow execution/import skill with registry/review constraints and operational features around running trusted ComfyUI workflows. The actual code chunk is narrowly a conversion utility for translating UI-format workflow JSON into API-format JSON, using a running ComfyUI front-end and Playwright, and explicitly states it does not trigger inference. While both relate to ComfyUI, the primary purpose is materially different. The code also accepts arbitrary source files/directories for conversion, which does not reflect the declared restriction that only registered or reviewed workflows are handled.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broader operational skill centered on safely running registered ComfyUI workflows and importing reviewed ones via a stable CLI on a trusted server. The actual code chunk is a static analysis/helper script for workflow JSONs. It parses workflow structure, infers node mappings and likely capability labels, lists required model filenames, and can identify custom plugins from provided object_info metadata. While this could support an import/preflight pipeline, by itself it does not implement the core declared behavior of running workflows, interacting with a ComfyUI server, checking server health, saving server settings, or enforcing reviewed-registry-only execution. Therefore the code chunk does not accurately represent the declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code chunk does not implement the declared core functions of running registered workflows, importing reviewed workflows into a private registry, checking server health, preflighting dependencies, or enforcing registry-only execution. Instead, it implements a workflow-format classifier and a conversion utility that can transform UI/Save workflow JSON into API-format JSON by automating the ComfyUI web front-end. That is a materially different primary purpose and adds an undeclared capability around converting arbitrary workflow files. While this may support a larger ComfyUI tooling ecosystem, based on the supplied chunk alone the description does not accurately represent what this code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code chunk only builds a large SVG string representing a decision tree and saves it under docs/decision-tree.svg. Although the SVG text embeds labels referring to CLI commands, health checks, preflight, executor behavior, and workflow handling, those are merely diagram contents, not implemented functionality. There is no network access to http://127.0.0.1:8188, no CLI parsing, no workflow registry enforcement, no import/review path, and no execution engine. Therefore the actual behavior of this code is materially different from the declared skill purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for an operational ComfyUI workflow-execution skill that interacts with a ComfyUI server and runs registered workflows. The actual code does none of that. It does not contact a ComfyUI server, run workflows, import workflows, perform health checks, manage server URLs, or generate image/video/music/speech. Instead, its primary purpose is repository packaging: copying files into a staging directory, excluding test/cache artifacts, validating required bundle structure, and creating a ZIP release bundle. This is a materially different purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for an operational ComfyUI workflow-running/import skill, but the supplied code is a maintenance/build utility for copying and normalizing package assets. Its primary behavior is traversing local directories, comparing files, writing updated copies, and deleting extra files in the destination. It does not expose or implement any of the described workflow execution, server interaction, dependency preflight, registry import, or media-generation features. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

- Source mode: run CLI commands from the skill root (the directory containing `SKILL.md` and `scripts/`).

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/comfy_api_simplified/api.py (reported line 164)May include surrounding context.

python

data = message["data"]
                if data["status"]["exec_info"]["queue_remaining"] == 0:
                    on_progress({"phase": "queue_empty", "prompt_id": prompt_id})
                    return prompt_id
            if mtype == "executing":
                data = message["data"]
                if data["node"] is None and data.get("prompt_id") == prompt_id:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/comfy_api_simplified/api.py (reported line 170)May include surrounding context.

python

data = message["data"]
                if data["status"]["exec_info"]["queue_remaining"] == 0:
                    on_progress({"phase": "queue_empty", "prompt_id": prompt_id})
                    return prompt_id
            if mtype == "executing":
                data = message["data"]
                if data["node"] is None and data.get("prompt_id") == prompt_id:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/comfyui/services/executor.py (reported line 156)May include surrounding context.

python

data = message["data"]
                if data["status"]["exec_info"]["queue_remaining"] == 0:
                    on_progress({"phase": "queue_empty", "prompt_id": prompt_id})
                    return prompt_id
            if mtype == "executing":
                data = message["data"]
                if data["node"] is None and data.get("prompt_id") == prompt_id:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/comfyui/services/executor.py (reported line 161)May include surrounding context.

python

data = message["data"]
                if data["status"]["exec_info"]["queue_remaining"] == 0:
                    on_progress({"phase": "queue_empty", "prompt_id": prompt_id})
                    return prompt_id
            if mtype == "executing":
                data = message["data"]
                if data["node"] is None and data.get("prompt_id") == prompt_id:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/comfyui/tools/import_workflow.py (reported line 82)May include surrounding context.

python

if not interactive:
        # Never block on stdin in CI / subprocess / scripted contexts.
        return PROMPT_NODE_UNRESOLVED

    print(
        "\nCould not auto-detect the prompt node. Pick the node field that "

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/comfyui/tools/import_workflow.py (reported line 104)May include surrounding context.

python

if not interactive:
        # Never block on stdin in CI / subprocess / scripted contexts.
        return PROMPT_NODE_UNRESOLVED

    print(
        "\nCould not auto-detect the prompt node. Pick the node field that "

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises shell, file, environment, and network-capable behavior but does not declare any explicit tool scope or allowed-tools boundary in the skill manifest. In an agent setting, missing scope declarations weakens least-privilege controls and can allow broader-than-expected execution paths if the host honors metadata for policy enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill prominently supports voice cloning but gives no explicit safety warning about consent, impersonation, fraud, or legal/ethical restrictions. In this context, omission increases the chance the agent will facilitate misuse of a high-risk biometric/media capability without guardrails.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 71% confidence

Finding

The skill instructs persistent storage of a server URL via save-server/config.local.json and describes a per-user data root, which creates session persistence. Persistence is not inherently unsafe, but without explicit consent boundaries, retention guidance, or handling of sensitive embedded credentials in URLs, it can expose internal endpoints or accidentally retain secrets across sessions.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md

1. Ensure a usable reference image exists; otherwise return Agent error `NO_REFERENCE_IMAGE`.
2. Ensure this runtime can inspect images; otherwise return Agent error `VISION_UNAVAILABLE`.
3. Read the reference prompt enhancement file and create one English prompt.
4. Call T2I generation with that prompt. Do not pass the reference image to ComfyUI.

Image-to-image flow:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Natural-language policy violations apply to all file types. The file contains prewritten English lyrics and explicitly sets language to en, with no indication that the user can choose another language or has opted into English-only output.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This manifest file uses very generic activation keywords such as "edit", "editing", "换", and "替换", which overlap with common everyday requests and are not narrowly scoped to this specific image-editing workflow. Although other fields add context, the trigger list itself lacks negative examples or tighter constraints, increasing the risk of accidental invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest uses very generic activation keywords such as "speech" and "voice" alongside multilingual equivalents. In a manifest file, such broad terms can match many ordinary user requests, increasing the chance of unintended workflow selection without clear scope constraints or negative trigger examples.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language policy checks apply to all file types. Setting "language": "Chinese" in the configuration imposes a specific locale by default, and this file contains no indication of user opt-in or justification for restricting the skill to that language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON workflow explicitly sets the language to "Chinese", which is a natural-language locale constraint. Because the file provides no indication of user choice, opt-in, or region-specific justification, it conflicts with the policy against forcing a specific language or locale.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This manifest file uses generic activation keywords such as "poster", "banner", and especially "标题" without explicit constraints or negative examples. Those terms overlap with common requests and may cause the workflow to be selected in situations where the user is not specifically asking for this text-to-image poster workflow.

Content

No source excerpt is available for this finding.