Security audit

Image With Comfyui

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does what it claims, but its default configuration can send user images and prompts to a non-local ComfyUI server without clear user-facing disclosure.

Before installing, review config.json and set COMFYUI_URL to a ComfyUI server you control, preferably localhost. Do not use this skill with sensitive images unless you are comfortable sending them to that endpoint and having outputs saved in the configured media directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documentation describes access to environment variables, local files, and a local network service, yet no explicit permissions are declared. This creates a governance gap: the skill can read configuration, access user-provided file paths, and contact ComfyUI without transparent consent boundaries or policy enforcement. In this context, the mismatch is more dangerous because the skill also handles persisted user media and output delivery paths.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The documentation instructs operators/agents to perform a shell-level file copy into a media outbound directory as part of delivery. That expands the skill from image generation into arbitrary filesystem manipulation, which can be abused if file paths are attacker-influenced or if the agent generalizes this pattern to other files. The risk is elevated because the skill already processes local paths and instructs direct handling of generated artifacts.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The skill directs the agent to retain a previously received image path/URL and reuse it in a later turn, extending processing beyond a single immediate request. This introduces cross-turn statefulness for user media without explicit re-confirmation, which can lead to privacy mistakes, unintended reuse of the wrong image, or processing after user intent has changed. The impact is lower than direct code execution, but the behavior is still risky in a media-handling skill.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The skill uploads user-supplied local images to whatever ComfyUI endpoint is configured, including one supplied via the COMFYUI_URL environment variable, without an explicit user-facing warning or trust check at the upload path. In this skill context, that can expose sensitive local images to a remote or attacker-controlled server, making data exfiltration a realistic risk.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Automatically retaining a user's image and applying a later text request to it without re-confirmation can cause unintended processing of sensitive media. A mistaken or ambiguous follow-up message could trigger edits or video generation on the wrong asset, and the instruction explicitly discourages asking the user to verify. In a skill that handles personal images, this context makes the privacy and consent risk materially more significant.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config.json:2