Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed ComfyUI client for generating and editing media; its network and file behavior matches that purpose.
Install only if you control or trust the configured ComfyUI endpoint. Prompts, workflow JSON, source images for edit/video/mesh modes, and any configured bearer API key are sent to that endpoint; prefer localhost or trusted HTTPS servers and avoid sensitive media unless the endpoint and output location are acceptable.
Referenced artifact was not completely inspected
1. **Never re-read on repeat.** Don't re-read `SKILL.md`, `config.json`, or the script for a known config / repeat / same-model job. Defaults are baked in; `--a
The skill performs outbound network access to a user-configurable ComfyUI server, uploads prompts and source images, and downloads generated files. This is a true capability/permission gap because network access materially changes the trust boundary and can exfiltrate sensitive prompts, images, and bearer credentials to remote infrastructure.
The skill performs outbound network access to a user-configurable ComfyUI server, uploads prompts and source images, and downloads generated files. This is a true capability/permission gap because network access materially changes the trust boundary and can exfiltrate sensitive prompts, images, and bearer credentials to remote infrastructure.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
prompt_id = result.get("prompt_id")
error_msg = result.get("error", {}).get("message", "") if "error" in result else ""
return prompt_id, error_msg if error_msg else None, warnings
def wait_for_completion(cfg: dict, prompt_id: str, timeout: int = 120) -> dict:
start = time.time()
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
prompt_id = result.get("prompt_id")
error_msg = result.get("error", {}).get("message", "") if "error" in result else ""
return prompt_id, error_msg if error_msg else None, warnings
def wait_for_completion(cfg: dict, prompt_id: str, timeout: int = 120) -> dict:
start = time.time()
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
prompt_id = result.get("prompt_id")
error_msg = result.get("error", {}).get("message", "") if "error" in result else ""
return prompt_id, error_msg if error_msg else None, warnings
def wait_for_completion(cfg: dict, prompt_id: str, timeout: int = 120) -> dict:
start = time.time()
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
prompt_id = result.get("prompt_id")
error_msg = result.get("error", {}).get("message", "") if "error" in result else ""
return prompt_id, error_msg if error_msg else None, warnings
def wait_for_completion(cfg: dict, prompt_id: str, timeout: int = 120) -> dict:
start = time.time()
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
prompt_id = result.get("prompt_id")
error_msg = result.get("error", {}).get("message", "") if "error" in result else ""
return prompt_id, error_msg if error_msg else None, warnings
def wait_for_completion(cfg: dict, prompt_id: str, timeout: int = 120) -> dict:
start = time.time()
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
prompt_id = result.get("prompt_id")
error_msg = result.get("error", {}).get("message", "") if "error" in result else ""
return prompt_id, error_msg if error_msg else None, warnings
def wait_for_completion(cfg: dict, prompt_id: str, timeout: int = 120) -> dict:
start = time.time()
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def sanitize_filename(filename: str, output_dir: Path) -> str | None:
"""Sanitize a filename from a remote ComfyUI server.
Prevents path traversal attacks (e.g. `../../../etc/passwd`) by:
1. Stripping all directory components — only the bare basename is kept
2. Rejecting empty names, `..`, `.`, or names containing path separators
3. Verifying the final resolved path stays within output_dir
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
with open(workflow_path, "r", encoding="utf-8") as f:
workflow = json.load(f)
# Fill prompt node
found = False
for node_id, node_data in workflow.items():
ct = node_data.get("class_type", "")
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
with open(workflow_path, "r", encoding="utf-8") as f:
workflow = json.load(f)
# Fill prompt node
found = False
for node_id, node_data in workflow.items():
ct = node_data.get("class_type", "")
The document explicitly tells the agent to delete staged files after sending them, which is a destructive filesystem operation affecting user-generated content. The file does not warn the user that temporary copies will be created and then removed, nor does it frame this behavior as something the user should expect.
This plain-text file contains the Chinese phrase "ComfyUI 格式" in otherwise English instructions. The file does not indicate a multilingual mode, user language choice, or a documented reason for mixing locales here, which can conflict with language/locale consistency policy.
This JSON manifest defines a full media-generation workflow but contains no natural-language description of when it should be invoked, what user intents it is meant to match, or any exclusion conditions. For manifest files, the absence of specific trigger scope can lead to overly broad or unintended invocation by surrounding tooling that relies on manifest metadata.
Detected: suspicious.install_untrusted_source