Relight — Pro Pack on RunComfy

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for RunComfy image relighting, but its install instructions run a mutable unpinned npm CLI, including automatic npx execution.

Install only if you are comfortable sending images and prompts to RunComfy and using its CLI. Prefer a pinned, locally locked CLI version with provenance or checksum verification instead of `npx -y` latest, and review where the token and generated outputs are stored.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

Unpinned Third-Party CLI Installation and Automatic Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 42
Vulnerability Type: Unpinned third-party dependency installation and execution
Risk Level: Medium

bash

npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version

Technical Analysis

The documented commands retrieve the current version of @runcomfy/cli from the configured npm registry without specifying an exact version or verifying an integrity hash. The npm i -g variant installs the package globally, while npx -y retrieves and executes the resolved package without interactive confirmation.

npm packages can run lifecycle scripts during installation. Consequently, a compromised publisher account, malicious future package release, dependency-chain compromise, or compromised package registry could cause attacker-controlled code to execute when these instructions are followed. The reviewed skill does not itself contain a malicious payload, and the package name is consistent with the declared RunComfy service; the risk arises from executing mutable, unverified third-party content.

Attack Path

1. An attacker compromises the package publisher, a transitive dependency, or the package distribution channel.
2. The attacker publishes a malicious version that is selected by npm as the current release.
3. A user or agent follows the installation command in SKILL.md.
4. npm downloads the unpinned package and may execute its installation lifecycle scripts.
5. The malicious code executes with the privileges and environment of the invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. Depending on that account's access, the payload could read accessible files and environment variables, capture RunComfy or other credentials, access images being processed, modify user-owned files, or install additional user-level components. Global installation also modifies a s ...[truncated 218 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a reviewed exact version, for example @runcomfy/cli@X.Y.Z, rather than resolving the mutable latest release.
• Publish and verify the expected npm integrity digest or package provenance before installation.
• Prefer a project-local dependency managed through a committed lockfile instead of global installation.
• Remove the automatic-confirmation npx -y example, or require explicit verification before first execution.
• Disable lifecycle scripts during package acquisition where operationally possible, then review the package before enabling any required installation steps.
• Document a trusted registry configuration and recommend checking package ownership, signatures, and provenance.
• Establish a controlled update process in which new versions are reviewed and tested before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list is broad and includes common phrases like 'change the lighting', 'golden hour', and 'studio lighting', which can match ordinary conversation rather than an explicit request to invoke this skill. That increases the chance of unintended activation, causing unapproved external API calls, processing of user images, or token use in contexts where the user did not clearly consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs use of npx -y @runcomfy/cli without a pinned version, which causes execution of whatever package version is latest at invocation time. This creates a supply-chain risk: if the package is compromised or a breaking/malicious release is published, an agent or user could run unreviewed code on their system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

In the Security & Privacy section, the skill explicitly recommends npx -y @runcomfy/cli as a verified installation method, but npx without version pinning still fetches and executes the latest package. That undermines the safety claim and exposes users to package-replacement or compromised-release attacks.

Content

No source excerpt is available for this finding.