Security audit

ComfyUI画图基础版

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a local ComfyUI image-generation skill, but it asks for broad file, command, and network-related authority without clear limits.

Review before installing. This skill appears intended for local ComfyUI image generation, not theft or damage, but only install it if you are comfortable granting an agent command execution plus local file read/write access. Avoid using callback_url unless you trust the destination, and treat generated prompts and images as locally stored files that may need manual cleanup.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill advertises itself as a local-only ComfyUI client with no broader integration, yet it accepts a `callback_url` for asynchronous completion notifications. That creates an undocumented outbound network path that could send task metadata or results to arbitrary destinations, undermining user expectations about locality and increasing SSRF/data-exfiltration risk.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The documentation expands the skill's apparent scope to generic file handling, external API calls, command execution, and information retrieval, which goes well beyond the declared purpose of local image generation. This scope inflation can cause an agent to invoke powerful capabilities under an innocuous creative-tool label, increasing the chance of unauthorized file access, network activity, or command execution.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: Describing the primary `input` as arbitrary 'input data or instructions' makes the skill trigger surface overly broad. In a skill that also declares `exec`, `read`, and `write` tools, vague invocation semantics can let unrelated or unsafe requests be funneled into a powerful execution context without clear boundaries.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: Claiming compatibility with essentially any agent platform that supports SKILL.md, without activation constraints or security assumptions, broadens deployment into environments with very different trust and permission models. That increases the likelihood that the skill's exec/read/write abilities are exposed in contexts where users do not expect those privileges.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documented `callback_url` introduces outbound network transmission, but the skill does not clearly warn that generation status or result metadata may be sent off-host. In a tool marketed as local GPU image generation, this mismatch can surprise users and enable exfiltration or SSRF if an attacker controls the callback destination.

Missing User Warnings

Low

Confidence: 73% confidence
Finding: The skill states that generated images are written to a workspace temporary directory, but it does not clearly warn users about local file creation, retention, and possible sensitivity of prompts or outputs. While expected for an image-generation tool, silent persistence can still expose private or policy-violating content to other local processes or users.

Static analysis

No suspicious patterns detected.