Flux Kontext Pro — Pro Pack on RunComfy

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.0

Overview

This is a disclosed RunComfy image-editing helper, with cautions around the global CLI install, stored RunComfy credentials, and a broad trigger word.

Install only if you are comfortable using RunComfy as an external image-editing service. Prefer a pinned or isolated @runcomfy/cli install, use a revocable RunComfy token, avoid exposing unrelated secrets to the CLI process, and confirm ambiguous requests before sending image URLs or prompts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Unpinned Global Installation of a Privileged Third-Party CLI

Content

View full analysis

` instead of `runcomfy login`. ``` ### Technical Analysis The installation command retrieves and globally installs the latest available release of `@runcomfy/cli` without an exact version, integrity hash, lockfile, or other reproducibility control. The globally installed package may execute lifecycle scripts during installation and arbitrary JavaScript under the invoking user's account when run. The Skill subsequently relies on this CLI to handle the RunComfy authentication token, user prompts, source-image URLs, local output paths, API responses, and generated files. A compromised npm package, malicious dependency update, or unexpectedly unsafe future release could therefore access this sensitive context. The external network transmission performed by the documented CLI workflow is otherwise consistent with the Skill's declared hosted image-editing functionality. `SKILL.md` discloses that prompts and image URLs are sent to the RunComfy Model API over HTTPS. No evidence of covert exfiltration, direct token disclosure by the Skill, or network access unrelated to the declared function was identified. ### Attack Path 1. An attacker compromises the `@runcomfy/cli` npm package, one of its transitive dependencies, or a future package release. 2. A user follows the documented prerequisite and runs `npm i -g @runcomfy/cli`. 3. Because no version or integrity value is pinned, npm retrieves the currently published package rather than a specifically reviewed artifact. 4. Malicious code executes through an installation lifecycle script or when the user invokes `runcomfy`. ...[truncated 1533 chars]

Remediation

View remediation

``` 2. Publish the expected package version and integrity hash in the Skill documentation. Require users or deployment tooling to verify the downloaded artifact before execution. 3. Prefer a project-local dependency with a committed lockfile over global installation. Invoke the locked dependency through a controlled package script or `npm exec` configuration that does not resolve an unspecified latest version. 4. Disable npm lifecycle scripts during installation where compatible with the CLI: ```bash npm install --global --ignore-scripts @runcomfy/cli@ ``` If lifecycle scripts are required, document and review each script before recommending installation. 5. Establish an explicit dependency-update process that reviews release notes, package ownership, transitive dependency changes, and published package contents before changing the pinned version. 6. Run the CLI under a dedicated, least-privileged account or isolated container with access only to the necessary output directory and RunComfy credential. 7. Use a narrowly scoped, revocable service token in CI. Avoid exposing unrelated secrets to the CLI process, and rotate the token immediately if package compromise is suspected. 8. Document the privacy boundary clearly: prompts, source-image URLs, and generated content are processed by the external RunComfy service and should not contain sensitive information unless the user has approved that disclosure. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger list includes the single generic term "kontext", which is broad enough to cause accidental routing when a user mentions the word in another context rather than explicitly requesting this skill. That can lead to unintended invocation of a third-party image-editing workflow, including sending user-provided image URLs and prompts to RunComfy without strong user intent.

Content

No source excerpt is available for this finding.