Security audit

Multishot UGC

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated image-generation purpose, but its downloader trusts remote filenames and could write files outside the chosen output folder.

Install only if you are comfortable sending source images and prompts to ComfyDeploy and using a local API key. Before use, the downloader should be fixed to sanitize remote filenames, enforce that writes stay inside the output directory, avoid overwriting existing files by default, and preferably use a lock file for dependencies.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate.py:139
Finding: Remote-Controlled Filename Allows Path Traversal and Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/pyproject.toml:6
Finding: Unbounded and Unlocked Third-Party Dependency Resolution
Content: View full analysis
=2.28.0", ] ``` ### Technical Analysis The project declares only a lower bound for `requests` and the audited directory contains no dependency lock file. A future installation may therefore resolve to a package version that was not present or reviewed during this audit. The package name is legitimate and there is no evidence of typosquatting, dependency confusion, or a currently malicious release. The weakness is the lack of reproducible dependency resolution: changes in the package registry, dependency graph, or future releases can alter the code installed and executed by `uv run`. ### Attack Path 1. A future release of `requests` or a transitive dependency is compromised, malicious, or unexpectedly incompatible. 2. A user runs the Skill in an environment without a previously verified lock file. 3. The package manager resolves a version satisfying `requests>=2.28.0`, potentially selecting the affected release. 4. Package installation or import causes the unreviewed dependency code to execute with the same privileges as the Skill. This is a conditional supply-chain path rather than evidence that the currently named dependency is malicious. ### Impact Assessment A compromised dependency could execute code with the permissions of the user invoking the Skill and access data available to that process, including the `COMFY_DEPLOY_API_KEY`, source images, generated files, and other user-accessible resources. The practical likelihood is low because the dependency is a well-known package and no malicious version was identified in the audited material. The absence of a lock file nevertheless prevents assurance that future installations use the same reviewed dependency set. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tainted flow: 'headers' from os.environ.get (line 43, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/generate.py (reported line 45)May include surrounding context.
python
files = {"file": (os.path.basename(file_path), f)} headers = {"Authorization": f"Bearer {api_key}"} response = requests.post( f"{COMFY_DEPLOY_API_URL}/file/upload", headers=headers, files=files

Tainted flow: 'headers' from os.environ.get (line 43, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/generate.py (reported line 95)May include surrounding context.
python
} } response = requests.post( f"{COMFY_DEPLOY_API_URL}/run/deployment/queue", headers=headers, json=payload

Tainted flow: 'headers' from os.environ.get (line 43, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/generate.py (reported line 119)May include surrounding context.
python
if time.time() - start_time > timeout: raise TimeoutError(f"Run did not complete within {timeout} seconds") response = requests.get( f"{COMFY_DEPLOY_API_URL}/run/{run_id}", headers=headers )

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/generate.py (reported line 27)May include surrounding context.
python
def get_api_key(): """Get API key from environment or raise error.""" api_key = os.environ.get("COMFY_DEPLOY_API_KEY") if not api_key: raise ValueError(

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs use of a script and an external API endpoint, which implies network access and likely environment access, but it does not declare any explicit tool scope or permission boundaries. That makes the capability set opaque to the agent/runtime and increases the risk of over-privileged execution, unexpected data exposure, or misuse of local secrets when the skill is invoked.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
import requests # ComfyDeploy API configuration COMFY_DEPLOY_API_URL = "https://api.comfydeploy.com/api" DEPLOYMENT_ID = "9ccbb29a-d982-48cc-a465-bae916f2c7fd" DEFAULT_TEXT = "Explora distintas perspectivas de esta escena"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/generate.py (reported line 20)May include surrounding context.
python
import requests # ComfyDeploy API configuration COMFY_DEPLOY_API_URL = "https://api.comfydeploy.com/api" DEPLOYMENT_ID = "9ccbb29a-d982-48cc-a465-bae916f2c7fd" DEFAULT_TEXT = "Explora distintas perspectivas de esta escena"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script uploads a user-supplied local image to a third-party API without an explicit warning or consent step at the point of use. In this skill context, inputs are likely marketing or user-generated photos that may contain faces, products, metadata, or other sensitive content, so silent transmission creates a meaningful privacy and compliance risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/generate.py (reported line 95)May include surrounding context.
python
} } response = requests.post( f"{COMFY_DEPLOY_API_URL}/run/deployment/queue", headers=headers, json=payload

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The default text literal is in Spanish, which imposes a specific language choice on users who do not provide --text. There is no accompanying opt-in, locale selection, or justification that this skill is intended only for Spanish-language use.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: The dependency specification uses a broad lower bound for requests (>=2.28.0) rather than pinning to a known-safe version, so builds may resolve to a release affected by one of multiple published advisories. In a skill that may fetch remote assets or APIs during image-processing workflows, that uncertainty creates avoidable supply-chain and runtime risk even though the manifest itself does not prove an exploitable version is installed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.