Image Inpainting — Pro Pack on RunComfy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.0

Overview

This inpainting skill is mostly coherent, but it should be reviewed because it explicitly supports watermark removal and tells users to run an unpinned third-party CLI with account access.

Review this before installing. Use it only for images you have rights to edit, avoid watermark or attribution removal, and prefer a pinned, locally installed RunComfy CLI version rather than unpinned global npm or `npx -y`. Treat any uploaded images, masks, prompts, and generated outputs as data sent to RunComfy, and use a narrowly scoped token where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Unpinned Executable Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38–39
Vulnerability Type: Unpinned executable npm dependency
Risk Level: Medium

Vulnerable Code

bash

# 1. Install (see runcomfy-cli skill for details)
npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version

Technical Analysis

The documented installation commands do not pin @runcomfy/cli to an exact, audited version. Both npm i -g @runcomfy/cli and npx -y @runcomfy/cli --version resolve package content from the npm registry at execution time. The npx command also executes the resolved package automatically, while the global installation places executable third-party code outside the project directory.

The project contains only SKILL.md; it provides no lockfile, vendored source, integrity hash, or other mechanism through which the installed CLI implementation can be verified as part of this audit. Consequently, the claims in the document concerning token storage, outbound endpoint restrictions, absence of telemetry, shell safety, and download limits cannot be independently validated from the audited artifact.

This creates a supply-chain exposure: a compromised maintainer account, malicious or unexpectedly changed release, registry compromise, or dependency-level compromise could cause arbitrary package or lifecycle code to run under the invoking user's account.

Attack Path

1. An attacker compromises the @runcomfy/cli package, one of its dependencies, its publishing account, or the package-distribution channel.
2. The attacker publishes a malicious release that is selected by the unversioned package specification.
3. A user or agent follows SKILL.md and runs either the global npm installation or automatic npx execution command.
4. npm retrieves the malicious package version and may run its lifecycle scripts; invoking the CLI executes its runtime code.
5. The malicious code operates with the permissions and en ...[truncated 1223 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact reviewed version, for example:

   bash

   npm install --save-exact @runcomfy/cli@X.Y.Z
   

2. Prefer a project-local installation over a global installation, and invoke the locked binary from the local dependency tree.
3. Commit an npm lockfile with integrity metadata and require immutable or lockfile-enforced installation in automated environments.
4. Verify package provenance, publisher identity, signatures or attestations where available, and registry integrity before installation.
5. Avoid automatic execution of dynamically resolved packages through unpinned npx -y.
6. Disable npm lifecycle scripts where operationally possible, or separately audit all required lifecycle scripts before allowing them.
7. Execute the CLI with least privilege in a sandbox or container that exposes only the required input/output paths and approved network destinations.
8. Provide credentials only for the duration of the operation, use a narrowly scoped token, and prevent unrelated processes or dependencies from accessing it.
9. Audit and document the pinned CLI implementation so that its token handling, endpoint allowlist, telemetry behavior, shell-safety guarantees, and download limits can be independently verified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly advertises watermark removal as a supported use case. That materially enables copyright-management information removal and can facilitate infringement or policy evasion by making prohibited editing capability easy to invoke.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The trigger list is broad and includes generic phrases like 'remove from image' and 'remove object', which can match ordinary image-editing requests outside the user's intended tool choice. Over-broad activation can cause unintended routing to this skill, resulting in unexpected third-party data transfer or edits being performed with the wrong workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill demonstrates uploading source images and masks to RunComfy, but the initial user-facing description does not prominently warn that potentially sensitive media is sent to a third-party service. Users may unknowingly expose private photos, embedded metadata, or proprietary images before informed consent is obtained.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill recommends executing npx -y @runcomfy/cli without pinning an exact version. That allows whatever package version is latest at execution time to run with the user's privileges, creating a supply-chain risk if a malicious or compromised release is published.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The examples provide concrete natural-language instructions for removing watermarks, lowering the barrier to misuse. Demonstrative prompts operationalize a policy-sensitive capability and make abusive usage more likely than a neutral technical description would.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The security section itself endorses npx -y @runcomfy/cli without a pinned version, which still permits unreviewed code execution from the package registry. Security guidance that normalizes floating versions increases the chance that agents or users will execute a compromised package.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.