ClawHub
Back to skill

Security audit

Comfyui Painter Tool Free

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a local ComfyUI image-generation guide, but its default commands expose the service to the wider network without access-control guidance.

Install only if you are comfortable running local shell commands and downloading ComfyUI/model dependencies. Before starting ComfyUI, change the listen address to localhost, such as 127.0.0.1, unless you intentionally need remote LAN access and have firewall or authentication protections in place.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

High
Confidence
98% confidence
Finding
Binding ComfyUI to 0.0.0.0 exposes the service on all network interfaces, potentially making an unauthenticated local tool reachable by other devices on the LAN or beyond if port forwarding/firewall rules allow it. In the context of an exec-capable agent skill, this increases risk because the service may accept arbitrary workflow submissions or disclose generated content/history without any mention of access control.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.