Comfyui Painter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a disclosed local ComfyUI and CivitAI workflow, but it asks for exec-driven local changes and has under-scoped credential, download, config-write, callback, and Discord-sharing behavior.

Review this skill before installing. Use it only in an environment where exec access, large model downloads, config writes, local ComfyUI process control, and CivitAI network calls are acceptable. Treat the CivitAI key file as a secret, restrict its permissions, confirm any callback or Discord destination before use, and prefer pinned dependencies or an isolated virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:65

Finding

Unpinned Python Dependency Creates Mutable Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 65
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown

| requests | Python library | Required | pip install requests |

Technical Analysis

The installation instruction retrieves requests without specifying an approved version, validating package hashes, or using a locked dependency manifest. Consequently, the installed package and its transitive dependencies may change between executions even when the Skill itself has not changed.

This does not establish that the legitimate requests package is malicious. It creates a conditional supply-chain risk: if an upstream release, transitive dependency, configured package index, or package-index account is compromised, following the documented command could install attacker-controlled code. Python packages and their installation artifacts may execute code during installation or when imported.

Although the package name is established and not an apparent typosquat, version and artifact verification are still required for reproducible, reviewable installation.

Attack Path

1. An attacker compromises an upstream package release, a transitive dependency, or the package source configured in the execution environment.
2. The Agent or user follows the Skill setup instructions and runs pip install requests.
3. pip resolves the current mutable package and dependency versions without checking them against an approved lock file or expected hashes.
4. The compromised artifact is installed.
5. Attacker-controlled code executes during installation or when the dependency is subsequently imported by the Skill's Python processes.

This path is conditional upon compromise or manipulation of the dependency supply chain; the audited project does not itself contain a malicious package or payload.

Impact Assessment

Malicious dependency code would ...[truncated 682 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unrestricted command with a reviewed, version-pinned dependency manifest, such as requirements.txt.

2. Pin both direct and transitive dependencies to exact versions.

3. Record and enforce artifact hashes using a command such as:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Generate and review the lock file with a dependency-locking tool, and update it through a controlled review process.

5. Explicitly use an approved package index and prohibit untrusted extra indexes.

6. Install dependencies inside an isolated virtual environment rather than the system Python environment.

7. Do not run package installation with root or administrator privileges.

8. Add automated dependency vulnerability and integrity scanning to release review.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes one-click model downloads, automatic parameter extraction, and config cache writes without prominently warning that it will modify local files. In an agent context with exec access, undocumented writes can surprise users, overwrite local configuration, consume disk space, or introduce unreviewed model artifacts into the local environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L032 explicitly states that model training and fine-tuning are outside the skill's scope. However, L048 lists '自定义模型微调' as a paid capability, directly contradicting that boundary and creating intent confusion about whether the skill should support fine-tuning.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill advertises outbound callback and later Discord messaging despite its primary purpose being local image generation and model management. Unnecessary outbound communication expands the attack surface for data exfiltration, SSRF-like misuse, or unintended disclosure of prompts, file paths, and generated outputs, especially because no trust boundary or destination restrictions are documented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Callback URL support is documented with no privacy or network-transmission warning, even though generated content, prompts, metadata, and file references may be sent off-host. In a local creative workflow, that makes the feature more dangerous because users may assume processing remains entirely local while the skill can transmit data externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents model downloads and bulk updates that automatically change local files and config state, but does not place a prominent warning or confirmation step near those operations. Because models are large external artifacts and config aliases are rewritten automatically, misuse can lead to unwanted persistence, storage exhaustion, workflow breakage, or installation of unreviewed content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill tells users to store the CivitAI API key in a specific local file path and includes a check command. While it says not to print the key, it does not explicitly warn that this file contains a secret and should have restricted permissions or be excluded from sharing/backups.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.