ClawHub
Back to skill

Security audit

ComfyUI绘画专业版

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed ComfyUI image-generation helper with local ComfyUI calls and optional CivitAI model downloads, with some security documentation that users should not over-rely on.

Install only if you intend to let an agent run ComfyUI-related scripts, read selected input images, write model files, and optionally contact CivitAI. Keep the ComfyUI URL on localhost unless you have a trusted HTTPS remote setup, and treat downloaded AI models as third-party artifacts that should come from sources you trust.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The skill's security documentation claims HTTPS and SSL verification are enforced, but the implementation uses plain HTTP to the ComfyUI endpoint. Even though the endpoint is shown as localhost, the mismatch is security-relevant because users may rely on the stated guarantee and later adapt the URL to a remote host without transport protection, enabling interception or tampering.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill is presented as a local AI painting tool, but it also performs external CivitAI API access and downloads model files from the internet. This increases risk because prompts, metadata, and downloaded artifacts cross trust boundaries, and users may not expect network egress or ingestion of untrusted model files in a supposedly local workflow.

External Transmission

Medium
Category
Data Exfiltration
Content
width=width,
            height=height
        )
        response = requests.post(f"{self.url}/prompt", json={"prompt": workflow})
        return response.json().get("prompt_id")
    def _build_workflow(self, prompt, negative_prompt, model, seed,
                        sampler, scheduler, steps, cfg, denoise,
Confidence
87% confidence
Finding
The skill transmits user-supplied prompts and workflow data to an HTTP endpoint and also includes optional external API usage elsewhere, creating data egress beyond the immediate agent context. In this skill context, that is more dangerous because the tool has Bash, file write, and network capabilities, and users may assume image-generation inputs stay local or private.

Static analysis

No suspicious patterns detected.