Security audit
Security checks across malware telemetry and agentic risk
The skill appears aimed at AI fashion image generation, but it also sends user assets to ComfyDeploy and appears to run an under-disclosed local usage-tracking script.
Review this before installing if you will use private product photos, model images, client assets, or identifiable people. The ComfyDeploy upload is expected for the advertised workflow, but the package should more clearly disclose that upload and should remove, disable, or make opt-in the local usage-tracking script before sensitive use.
"--type", "image",
"--status", status
]
subprocess.run(cmd, capture_output=True, timeout=10)
except Exception as e:
print(f"Warning: Failed to track usage: {e}", file=sys.stderr)p = Path(filepath)
mime = "image/png" if p.suffix == ".png" else "image/jpeg"
with open(p, "rb") as f:
r = requests.post(
"https://api.comfydeploy.com/api/file/upload",
headers={"Authorization": f"Bearer {api_key}"},
files={"file": (p.name, f, mime)},66/66 vendors flagged this skill as clean.
No suspicious patterns detected.