Image Edit — Pro Pack on RunComfy

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.0

Overview

This is a coherent RunComfy image-editing skill, but installing it requires trusting the external RunComfy CLI and sending image-edit inputs to RunComfy.

Install only if you are comfortable trusting the RunComfy CLI from npm and sending image URLs, masks, prompts, and generated outputs through RunComfy. Prefer installing a reviewed pinned CLI version, avoid sudo, and use a least-privileged token/account for sensitive images.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:71

Finding

Unpinned Global Installation of a Privileged Third-Party CLI

Content

View full analysis

Remediation

View remediation

``` 2. Publish the expected package version and integrity digest in the Skill documentation, and verify package provenance before installation. 3. Prefer a project-local dependency with a committed lockfile over a global installation. Invoke it through a controlled package script or an equivalent isolated mechanism. 4. Avoid running npm installation commands with `sudo`, as administrator, or from another privileged account. 5. Disable installation lifecycle scripts where operationally possible, or explicitly document and audit any lifecycle scripts the package requires. 6. Run the CLI under a dedicated least-privileged account or sandbox with access only to the required token, input references, and output directory. 7. Restrict outbound traffic to the documented RunComfy API and download domains, and verify that the installed CLI does not contact unexpected destinations. 8. Rotate the RunComfy token and investigate local file access if package compromise is suspected. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: image-edit-runcomfy
displayName: "🫧 Image Edit — Pro Pack on RunComfy"
description: >
  Image edit on RunComfy. This image edit skill transforms an existing
  image — background swap, object removal, in-image text rewrite, mask-
  driven region replacement, or any other image edit task — by routing
  the image edit request to the right model in the RunComfy catalog.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

multi-reference image edit, and mask-based image edit at up to 4K.
  Calls `runcomfy run <model>/edit` through the local RunComfy CLI.
  Triggers on "image edit", "edit image", "image-to-image", "i2i",
  "image editing", "swap background", "remove object", "rewrite
  headline", or any explicit ask to edit an image.
emoji: "🫧"
homepage: https://www.runcomfy.com

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition includes broad phrases such as "any explicit ask to edit an image," which can cause the skill to activate in contexts the user did not intend. Over-broad routing increases the chance of mis-execution on unrelated prompts and may send user-supplied images or instructions to an external service unexpectedly.

Content

No source excerpt is available for this finding.