AI Image Generation — Pro Pack on RunComfy

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.0

Overview

This is a coherent RunComfy image-generation helper with disclosed API-token and network use; the main caution is its unpinned npm/npx CLI setup guidance.

Install only if you are comfortable using RunComfy's CLI and sending prompts, reference-image URLs, and generated-output requests to RunComfy. Prefer a pinned, reviewed CLI version or a project-local install, protect `RUNCOMFY_TOKEN` and `~/.config/runcomfy/token.json`, and only enable web search or pass reference URLs when you intend those external inputs to affect generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Third-Party CLI Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–44
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

npm i -g @runcomfy/cli                              # global install
npx -y @runcomfy/cli --version                      # zero-install

Technical Analysis

The documented installation commands resolve @runcomfy/cli without specifying a reviewed version or integrity digest. As a result, the code retrieved and executed can change after the Skill has been audited.

The npx -y command automatically downloads and executes the package without an interactive confirmation. The global installation command also persists the package outside the project and exposes its executable to later shell sessions. Because the package source and lockfile are not included in the audited project, its installation scripts, transitive dependencies, runtime behavior, telemetry, endpoint restrictions, and handling of credentials cannot be independently verified by this audit.

This is a supply-chain weakness rather than evidence that the current package is malicious. It nevertheless permits a compromised npm publisher account, registry response, package release, or transitive dependency to turn the documented setup process into arbitrary local code execution.

Attack Path

1. An attacker compromises the @runcomfy/cli publication account, package, or one of its install-time/runtime dependencies.
2. The attacker publishes a malicious release under the same package name.
3. A user or Agent follows SKILL.md and runs either unversioned command.
4. npm resolves the attacker-controlled release because no version or integrity value is pinned.
5. Package lifecycle scripts or CLI initialization code execute with the privileges of the invoking user.
6. The malicious package can access resources available to that user, potentially including RUNCOMFY_TOKEN, ~/.config/runcomfy/token.json, projec ...[truncated 865 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @runcomfy/cli to a specifically reviewed version rather than resolving the latest release:

   bash

   npm install --save-exact @runcomfy/cli@REVIEWED_VERSION
   

2. Commit a lockfile containing resolved transitive dependency versions and integrity hashes.

3. Prefer a project-local installation over npm install -g to limit persistence and make dependency state auditable.

4. Avoid automatic npx -y download and execution. If npx is necessary, specify the reviewed version and require operator confirmation.

5. Configure npm to use an approved registry and verify package ownership, provenance, signatures, and integrity before installation.

6. Review lifecycle scripts and consider disabling them during installation where compatible:

   bash

   npm install --ignore-scripts --save-exact @runcomfy/cli@REVIEWED_VERSION
   

7. Run the CLI in a restricted environment with access only to the required output directory, input data, network destinations, and RunComfy credential.

8. Document an update process requiring review and integrity regeneration before changing the pinned version.

9. Remove obsolete global installations and verify the resolved executable path before invocation.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad natural-language phrases such as "generate image," "make a picture," and "AI image," plus a catch-all for any explicit ask to create or restyle an image with RunComfy. Overbroad activation increases the chance the skill runs unintentionally in contexts where the user did not mean to invoke this specific tool, causing unreviewed outbound API calls, token use, or file generation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

<model>/text-to-image` or `/edit` through the local RunComfy CLI.
  Triggers on "generate image", "make a picture", "text to image",
  "AI image", "make an image of …", "image to image", "i2i", or any
  explicit ask to create or restyle an image with RunComfy.
emoji: "🎨"
homepage: https://www.runcomfy.com
license: MIT

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill recommends executing npx -y @runcomfy/cli without pinning an exact package version, which allows whatever version is latest at execution time to be fetched and run. If the package is compromised, a malicious release is published, or a dependency-chain incident occurs, the agent/operator could execute unreviewed code with local user privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.