ComfyUI绘画免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.1

Overview

This ComfyUI image-generation skill is not clearly malicious, but it needs review because its setup instructions can expose a local service to the network and use under-specified dependencies.

Install only if you are comfortable reviewing and tightening the setup yourself: bind ComfyUI to 127.0.0.1 unless you intentionally need remote access, use a known ComfyUI repository and pinned revision, install in an isolated environment, and verify downloaded model files. Treat the broad AI/agent wording as documentation overreach, not permission for unrelated automation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:72

Finding

ComfyUI Service Exposed on All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 72 and 225
Vulnerability Type: Unnecessary network exposure of a local service
Risk Level: High

Vulnerable Code Snippet:

bash

# Start the ComfyUI service
cd ComfyUI
python main.py --listen 0.0.0.0 --port 8188

The same unsafe command is repeated later:

bash

# Start ComfyUI
python main.py --listen 0.0.0.0 --port 8188

# Generate the first image
python generate.py --prompt "a cat sitting on a windowsill" --output ./output/cat.png

Technical Analysis

The Skill instructs users to bind ComfyUI to 0.0.0.0, causing TCP port 8188 to listen on every available network interface. This is unnecessary for the documented workflow because the included Python example communicates with http://localhost:8188.

The instructions do not configure API authentication, TLS, reverse-proxy access controls, or host firewall restrictions. Therefore, when the host network and firewall permit access, other systems may directly interact with the ComfyUI HTTP API. The exact capabilities available to an attacker depend on the installed ComfyUI version and custom nodes.

Attack Path

1. A user or Agent follows the documented startup command.
2. ComfyUI binds port 8188 to all network interfaces.
3. An attacker on a reachable network discovers the exposed port.
4. The attacker connects directly to the ComfyUI API without passing an authentication layer.
5. The attacker submits unauthorized workflows or other requests supported by the installed ComfyUI instance and extensions.
6. The attacker consumes CPU, GPU, memory, and storage resources or accesses API-visible workflow data.

Impact Assessment

A reachable attacker may invoke image-generation workloads and cause resource exhaustion, denial of service, unwanted output creation, and storage consumption. The exposure may also reveal API-accessible workflow or generation data. If vulnera ...[truncated 258 chars]

Remediation

View remediation

Remediation Suggestions

Bind the service to the loopback interface for the documented local-only workflow:

bash

python main.py --listen 127.0.0.1 --port 8188

Additionally:

1. Block port 8188 from untrusted networks with a host or network firewall.
2. If remote access is required, place ComfyUI behind an authenticated reverse proxy with TLS.
3. Restrict access using explicit source-address allowlists.
4. Run ComfyUI under a dedicated, unprivileged operating-system account.
5. Review custom nodes before installation and limit their filesystem and process permissions.
6. Add a warning that 0.0.0.0 must not be used without deliberate access controls.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:204

Finding

Unpinned and Unspecified ComfyUI Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 204–210
Vulnerability Type: Unsafe and non-reproducible third-party dependency installation
Risk Level: High

Vulnerable Code Snippet:

bash

# Clone ComfyUI
git clone 
cd ComfyUI

# Install dependencies
pip install -r requirements.txt

Technical Analysis

The git clone command omits the repository URL and does not pin a reviewed tag or commit. Consequently, the instructions do not establish which repository contents should be trusted. The subsequent command installs dependencies from whichever ComfyUI/requirements.txt is present.

Python package installation can process package metadata and invoke build backends or installation hooks. An attacker-controlled repository or dependency set may therefore execute code during installation. No hash verification, dependency lock file, isolated environment, or source validation is specified.

Attack Path

1. A user or Agent attempts to complete the incomplete git clone instruction or uses an existing directory named ComfyUI.
2. Through error, social engineering, search-result manipulation, or local directory substitution, an unintended or attacker-controlled repository is selected.
3. The repository supplies a malicious requirements.txt or references a malicious package.
4. The user runs pip install -r requirements.txt.
5. Package build or installation logic executes with the privileges of the invoking account.
6. The malicious dependency can read, modify, or execute resources accessible to that account.

Impact Assessment

Successful exploitation can result in arbitrary code execution under the user account performing installation. This may expose that account's files, environment variables, credentials, network access, and writable project data. If installation is performed with administrative privileges, the impact could extend system-wide; however, the Skill does not ex ...[truncated 51 chars]

Remediation

View remediation

Remediation Suggestions

1. Specify the canonical ComfyUI repository using an explicit HTTPS URL.

2. Check out a reviewed, immutable commit rather than an unpinned branch:

   bash

   git clone https://github.com/comfyanonymous/ComfyUI.git
   cd ComfyUI
   git checkout --detach <reviewed-commit-sha>
   

3. Verify the repository origin and commit identity before installation.

4. Use a dependency lock file with exact versions and cryptographic hashes.

5. Install dependencies with hash enforcement where supported:

   bash

   python -m pip install --require-hashes -r requirements.lock
   

6. Use a dedicated virtual environment or isolated container.

7. Do not install as root or with administrator privileges.

8. Review dependency changes whenever the pinned ComfyUI revision is updated.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:215

Finding

Model Artifact Downloaded from a Mutable Reference Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 215–218
Vulnerability Type: Unverified third-party model artifact
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Download the SD1.5 model
cd models/checkpoints
wget https://huggingface.co/runwayml/stable-diffusion-v1-5/resolve/main/v1-5-pruned-emaonly.safetensors

Technical Analysis

The command uses HTTPS and downloads a .safetensors file, which reduces risks associated with unsafe object deserialization. However, it resolves the artifact through the mutable main reference and performs no digest or signature verification.

As a result, the installation is not reproducible and does not establish that the downloaded bytes match a reviewed model. An upstream replacement, repository compromise, or unintended artifact change could be accepted silently.

Attack Path

1. The upstream artifact or mutable main reference is changed or compromised.
2. A user follows the documented wget command.
3. HTTPS protects the connection to the hosting service but does not prove that the current artifact matches the version previously reviewed.
4. The unverified file is placed in the ComfyUI checkpoint directory.
5. ComfyUI loads and uses the altered model during generation.

Impact Assessment

A modified model can silently change generated content, introduce targeted output behavior, undermine reproducibility, or consume unexpected resources. Because the documented artifact uses the safetensors format, this finding alone does not establish arbitrary code execution. Its demonstrated impact is primarily model integrity and output trust.

Remediation

View remediation

Remediation Suggestions

1. Reference an immutable Hugging Face revision instead of main.

2. Publish the expected SHA-256 digest in the Skill documentation.

3. Verify the downloaded artifact before moving it into the checkpoint directory:

   bash

   wget -O v1-5-pruned-emaonly.safetensors \
     "https://huggingface.co/runwayml/stable-diffusion-v1-5/resolve/<immutable-revision>/v1-5-pruned-emaonly.safetensors"
   
   echo "<expected-sha256>  v1-5-pruned-emaonly.safetensors" | sha256sum --check -
   

4. Abort installation if verification fails.

5. Record the model revision, filename, digest, and license in a model manifest.

6. Continue preferring non-executable model formats such as safetensors.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation text is extremely broad, covering AI model calling, smart dialogue, agent orchestration, and LLM applications rather than only local image generation. Over-broad trigger language is dangerous in an agent ecosystem because it can cause this skill to be selected for unrelated tasks, exposing exec/read/write functionality in contexts with weaker user intent alignment.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The capability coverage section lists vague keyword triggers and broad scenario terms without clear boundaries. In tool-routing systems, this can act like prompt bait that captures unrelated tasks and may lead an agent to execute commands or write files when the user only asked a general AI question.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

# 等待完成并获取结果
    # ... 轮询 /history/{prompt_id} 获取结果
    return prompt_id

# 生成图像
generate_image(

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill’s declared purpose is a local ComfyUI text-to-image tool, but the documentation broadens its scope into generic AI/Agent/CRUD-style operations unrelated to that purpose. This kind of scope inflation can cause unintended invocation and misuse by an agent, increasing the chance that exec/read/write capabilities are applied in contexts the user did not request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description states '支持中文交互' in a way that presents Chinese as the interaction mode, but it does not offer user opt-in or indicate support for other languages. Under the language/locale policy, forcing a specific language without choice or a documented justification is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The feature summary lists Chinese interaction as a core capability but does not indicate that users may choose another language. This can be read as a language constraint rather than an optional supported locale.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation says the free edition only supports text-to-image, but also advertises generic modify/delete operation modes. Contradictory capability statements are dangerous because agents may infer permission to perform broader state-changing actions than intended, especially when write/exec tools are available.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The examples instruct launching ComfyUI with '--listen 0.0.0.0', which binds the service to all network interfaces, but no warning is given about remote exposure. If run on an untrusted network, other hosts may reach the service and potentially submit jobs, access generated content, or exploit weaknesses in the exposed application.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

}
    
    # 提交工作流
    response = requests.post(f"{COMFYUI_URL}/prompt", json={"prompt": workflow})
    prompt_id = response.json()["prompt_id"]
    
    # 等待完成并获取结果

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The capability table states that images are automatically saved to a local directory, which is a user-data-affecting behavior. Although saving is expected for an image tool, the markdown does not clearly warn users about where files will be written, possible overwrites, or storage/privacy considerations for generated content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The dependency section explicitly states the free version is fully local and needs no API key, and that communication is via local HTTP on port 8188. The later security table instead advises API-key handling and HTTPS certificate validation, which contradicts the documented architecture of a local HTTP-only tool with no credentials.

Content

No source excerpt is available for this finding.