Security audit
ComfyUI Image & Video Generation
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed ComfyUI helper for local image and video generation, with expected local file, localhost API, model download, and user-level service setup behavior.
Install this only if you intend to run ComfyUI locally and are comfortable with large model downloads and a user-level background service. Keep the ComfyUI URL on 127.0.0.1 unless you explicitly trust the remote server, because image-to-video mode can send the chosen image there.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
59/59 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.