Security audit

ControlNet & Pose — Pro Pack on RunComfy

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent RunComfy integration for pose-conditioned image and video generation, with a notable but disclosed supply-chain caution around installing the CLI from npm without a pinned version.

Install this only if you are comfortable using RunComfy's cloud service for the referenced media and prompts. Prefer a pinned, verified @runcomfy/cli version instead of a floating npm or npx install, use a least-privileged token where possible, and only provide media URLs you intend to send to RunComfy.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:38
Finding: Unpinned npm Package Installation and Execution
Content: View full analysis
Remediation: View remediation
npx --yes @runcomfy/cli@ --version ``` 2. Publish and verify the expected npm integrity hash or package signature before execution. 3. Record the approved package version and integrity metadata in the skill documentation and update them only after security review. 4. Prefer a project-local, lockfile-controlled installation over a global installation where operationally feasible. 5. Run package installation and execution as an unprivileged user in a constrained environment. 6. Consider disabling npm lifecycle scripts during installation when the CLI is verified to function without them: ```bash npm install --global --ignore-scripts @runcomfy/cli@ ``` 7. Restrict access to `RUNCOMFY_TOKEN` and RunComfy configuration files during dependency installation, and use a narrowly scoped or short-lived token where supported. 8. Use a trusted registry configuration and monitor the approved package for unexpected publisher, ownership, or release changes. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger condition includes a broad catch-all phrase like 'any explicit ask to condition generation on a pose / skeleton / motion / depth / canny reference,' which can cause the skill to activate in more contexts than intended. Over-broad activation increases the chance that an agent invokes this skill on ambiguous user requests, potentially sending user-supplied media URLs, prompts, or tokens into an external service when a narrower tool or no external call was warranted.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill instructs users to execute npx -y @runcomfy/cli without pinning an exact version, which allows whatever package version is current at execution time to run in the user's environment. If the package is compromised, a malicious update is published, or a dependency supply-chain issue occurs, the agent could fetch and execute unintended code with the user's privileges.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The security section explicitly recommends npx -y @runcomfy/cli as a valid install path, but this still executes an unpinned package version from the registry. Presenting this in the security guidance is especially risky because it may reassure users into treating a mutable remote package as trusted, increasing exposure to supply-chain compromise.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.