Comfyui Mcp Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:49 AM UTC
• Version: 1.0.0

Overview

This video-generation skill is mostly purpose-aligned, but it exposes powerful unauthenticated network tools and under-discloses cloud prompt transmission and broad local file access.

Review before installing. Use stdio or bind only to 127.0.0.1, put any HTTP deployment behind authentication and firewalling, run it as an unprivileged user in an isolated workspace, and avoid sensitive prompts unless you explicitly intend to send them to the configured cloud endpoint. The file download and FFmpeg tools should be patched to confine all paths before use in a shared or network-reachable environment.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

other

Error

• Location: utils/comfy_client.py:17
• Finding: Undisclosed transmission of user prompts and workflows to an external cloud service<![CDATA[ ## Vulnerability Details **File Location**: `utils/comfy_client.py:17-48`; related default configuration at `config/settings.yaml:1-2` **Vulnerability Type**: Undisclosed external data transmission **Risk Level**: High ### Vulnerable Code ```python COMFY_CLOUD_API = os.getenv('COMFY_CLOUD_API', settings['comfy_cloud_api']) COMFY_CLOUD_API_KEY = os.getenv('COMFY_CLOUD_API_KEY', settings['comfy_cloud_api_key']) def get_headers(): """Get API request headers.""" return {"X-API-Key": COMFY_CLOUD_API_KEY, "Content-Type": "application/json"} def submit_workflow(workflow_json): logger.info(f"Sending workflow to ComfyUI API: {COMFY_CLOUD_API}") logger.debug(f"Workflow data: {workflow_json}") try: r = requests.post( f"{COMFY_CLOUD_API}/api/prompt", json={"prompt": workflow_json}, headers=get_headers() ) ``` The destination defaults to an external service: ```yaml comfy_cloud_api: "https://cloud.comfy.org" comfy_cloud_api_key: "comfyui-xxx" ``` ### Technical Analysis The documentation and Skill metadata describe a local ComfyUI service configured through `COMFYUI_HOST` and `COMFYUI_PORT`. The implementation does not use those documented variables. Instead, it inserts the user's prompt into a workflow and submits the complete workflow to the externally hosted `cloud.comfy.org` endpoint. The transmitted object can include: - The user's video-generation prompt. - Workflow structure and node configuration. - Video duration, dimensions, and frame rate. - Any future sensitive values added to the workflow. This external transmission is not clearly disclosed in the documented local-only deployment model. It exceeds the minimum network privileges needed to communicate with a locally operated ComfyUI instance. The workflow is also logged in full at debug level, which could create an additional disclosure path if debug logging is enabled. ### Attack Path 1. A user installs the Skill bas ...[truncated 986 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use the documented local ComfyUI endpoint by default: - Construct the endpoint from `COMFYUI_HOST` and `COMFYUI_PORT`. - Default to `http://127.0.0.1:8188`. 2. If cloud processing is supported, make it an explicit, informed opt-in rather than the default. 3. Clearly document: - The external destination. - Exactly which fields are transmitted. - Data retention and privacy expectations. - The authentication mechanism. 4. Validate configured endpoints against an explicit allowlist or administrative policy. 5. Require HTTPS for non-loopback endpoints and configure reasonable connection and read timeouts. 6. Remove full workflow logging or redact prompts and other potentially sensitive values. 7. Align `README.md`, `SKILL.md`, `clawhub.json`, and implementation configuration names so operators can accurately enforce their intended trust boundary. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: tools/download_video.py:16
• Finding: Arbitrary filesystem write through attacker-controlled download paths<![CDATA[ ## Vulnerability Details **File Location**: `tools/download_video.py:16-40` **Vulnerability Type**: Path traversal and unrestricted file write **Risk Level**: High ### Vulnerable Code ```python @mcp.tool() def download_video(prompt_id: str, output_dir: str = "output/videos", filename: str = None) -> str: """ Download the video associated with a prompt ID. """ os.makedirs(output_dir, exist_ok=True) if not filename: filename = f"{prompt_id}.mp4" try: data = download_output(filename, "", "output") output_path = os.path.join(output_dir, filename) with open(output_path, "wb") as f: f.write(data) logger.info(f"Video saved to: {output_path}") return output_path except Exception as e: logger.error(f"Video download failed: {e}") raise ``` ### Technical Analysis Both `output_dir` and `filename` are directly controlled by an MCP caller. The implementation creates the supplied directory and opens the joined path without canonicalization or confinement to a dedicated output directory. The following path forms are accepted: - Absolute `output_dir` values. - Absolute `filename` values, which can override the joined directory. - Relative traversal components such as `../../`. - Symlinked destination directories or files. When no explicit filename is supplied, the attacker-controlled `prompt_id` is incorporated into the filename, providing another traversal source. The bytes written to disk come from the configured remote API. Consequently, an attacker who can invoke the tool and influence which remote object is returned can place remote content at any path writable by the MCP server account. ### Attack Path 1. An attacker obtains access to the MCP endpoint. 2. The attacker invokes `download_video` with an attacker-selected destination, such as an absolute path or a path containing `../`. 3. `os.makedirs` creates the selected directory where permissions ...[truncated 974 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove caller control over `output_dir`; configure one dedicated server-side output root. 2. Generate filenames on the server using a UUID or a strictly validated prompt identifier. 3. Reject: - Absolute paths. - Path separators in filenames. - `.` and `..` path components. - Device names and special files where applicable. 4. Resolve the final path and verify confinement before writing: ```python root = Path("output/videos").resolve() destination = (root / safe_filename).resolve() if root not in destination.parents: raise ValueError("Destination escapes the permitted output directory") ``` 5. Use exclusive creation where overwriting is unnecessary, such as mode `xb`. 6. Refuse symlinks and consider directory-relative APIs with no-follow semantics on supported platforms. 7. Enforce maximum response sizes and validate that downloaded content has the expected media type before writing it. 8. Run the service under a dedicated, unprivileged operating-system account with write access only to the output directory. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: tools/compose_video.py:15
• Finding: Unsafe arbitrary-path FFmpeg processing and insecure temporary manifest<![CDATA[ ## Vulnerability Details **File Location**: `tools/compose_video.py:15-45` **Vulnerability Type**: Unrestricted local file processing, arbitrary output path, and unsafe temporary file handling **Risk Level**: High ### Vulnerable Code ```python @mcp.tool() def compose_video(video_files: list, output_file: str = "final_video.mp4"): """ Compose multiple video files. """ logger.info(f"Composing {len(video_files)} files into: {output_file}") logger.debug(f"Input files: {video_files}") try: list_file = "list.txt" with open(list_file, "w") as f: for file in video_files: f.write(f"file '{file}'\n") logger.info(f"Created FFmpeg list file: {list_file}") logger.info("Running FFmpeg...") result = subprocess.run( ["ffmpeg", "-f", "concat", "-safe", "0", "-i", list_file, "-c", "copy", output_file], capture_output=True, text=True ) ``` ### Technical Analysis The MCP caller controls all input file paths and the output file path. These values are not canonicalized or confined to approved media directories. The FFmpeg command explicitly supplies `-safe 0`, disabling the concat demuxer's filename safety restrictions. Depending on the installed FFmpeg build and accepted input format, this can permit absolute paths and protocol-like paths that would otherwise be rejected. Although the code correctly avoids `shell=True`, this does not eliminate the underlying authorization issue: an unauthenticated or unauthorized remote caller can direct a privileged local process to access arbitrary paths and write output to an arbitrary destination. The concat manifest also introduces separate weaknesses: - It always uses the predictable file `list.txt`. - Concurrent requests overwrite the same manifest. - A preexisting `list.txt` symlink could redirect the manifest write. - Single quotes, newlines, or FFconcat syntax in a supplied path are no ...[truncated 1449 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Confine all input files to a dedicated media input directory. 2. Confine the output path to a dedicated media output directory. 3. Canonicalize every path and reject paths that escape the permitted roots. 4. Do not use `-safe 0`; retain the concat demuxer's safe-path checks. 5. Reject URL schemes, protocol prefixes, special files, and non-regular files. 6. Validate extensions and inspect media types before passing files to FFmpeg. 7. Create a unique manifest with `tempfile.NamedTemporaryFile` or `mkstemp`. 8. Escape FFconcat paths according to FFmpeg's required syntax, rather than interpolating raw strings. 9. Delete the temporary manifest in a `finally` block. 10. Add execution timeouts and resource limits to `subprocess.run`. 11. Use a restricted FFmpeg build or protocol allowlist where feasible. 12. Run FFmpeg in a sandboxed, unprivileged process with access only to the required media directories. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: server.py:21
• Finding: Unauthenticated MCP service binds to all network interfaces by default<![CDATA[ ## Vulnerability Details **File Location**: `server.py:21-35`; related startup declaration at `package.json:28` **Vulnerability Type**: Missing authentication and unsafe network exposure **Risk Level**: High ### Vulnerable Code ```python if __name__ == "__main__": parser = argparse.ArgumentParser(description="ComfyUI MCP Server") parser.add_argument("--transport", default="http", choices=["stdio", "http"], help="Transport mode") parser.add_argument("--host", default="0.0.0.0", help="Server address") parser.add_argument("--port", type=int, default=18060, help="Server port") parser.add_argument("--path", default="/mcp", help="HTTP path prefix") parser.add_argument("--show_banner", action="store_true", help="Show startup banner") args = parser.parse_args() mcp.run( transport=args.transport, host=args.host, port=args.port, path=args.path, show_banner=args.show_banner ) ``` The package startup script reinforces the public binding: ```json "start": "python server.py --transport http --host 0.0.0.0 --port 18060" ``` ### Technical Analysis The default HTTP transport listens on `0.0.0.0`, making the service reachable through every network interface permitted by the host firewall. The project does not configure an authentication or authorization boundary around the exposed MCP tools. This is particularly dangerous because the tools are not read-only. They can: - Submit cloud generation jobs. - Consume configured cloud API credentials. - Download and write remote data. - Invoke FFmpeg. - Read or write caller-selected filesystem paths. Binding such capabilities to all interfaces violates least privilege. Local nanobot integration can be implemented with stdio or a loopback-only HTTP listener and does not require public network exposure. ### Attack Path 1. The operator starts the server using its defaults or the documented package command. 2. The service listens on `0.0.0.0:180 ...[truncated 980 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default HTTP binding to `127.0.0.1`, not `0.0.0.0`. 2. Prefer stdio transport for local agent integration. 3. Require strong authentication before supporting remote HTTP access. 4. Add per-tool authorization so callers receive only the capabilities they need. 5. Place any remotely accessible deployment behind a hardened reverse proxy with: - TLS. - Client authentication or strong bearer-token authentication. - Request-size limits. - Rate limiting. - Network allowlisting. 6. Add request auditing without recording sensitive prompts or API keys. 7. Document firewall requirements and explicitly warn against direct Internet exposure. 8. Run the service as a dedicated unprivileged user with tightly constrained filesystem access. 9. Combine network controls with path confinement; authentication alone does not correct the filesystem vulnerabilities. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Unpinned executable dependencies create supply-chain and reproducibility risk<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1`; related mutable declarations at `package.json:34-35` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```text fastmcp requests==2.32.5 PyYAML==6.0.3 websockets==16.0 ``` Related package metadata explicitly uses mutable versions: ```json "dependencies": { "python": ">=3.10", "fastmcp": "latest", "requests": "latest" } ``` ### Technical Analysis `fastmcp` is installed without a version constraint in `requirements.txt`, while `package.json` describes `fastmcp` and `requests` as `latest`. This causes installations at different times to resolve to different code that has not necessarily been reviewed with the Skill. Python package installation may execute package build-system code, and imported dependencies execute with the privileges of the Skill process. A compromised upstream release, hijacked maintainer account, or unexpectedly incompatible future release could therefore alter installation or runtime behavior. The `package.json` declarations are also misleading because they describe Python packages as Node dependencies. Even if they are not used by the documented `pip` installation path, mutable and inconsistent declarations make dependency review and reproducibility harder. No evidence was found that the currently named packages are typosquatted or intentionally malicious. The confirmed issue is the unsafe mutable dependency policy. ### Attack Path 1. A user follows the installation instructions and runs `pip install -r requirements.txt`. 2. The resolver selects whatever `fastmcp` version is current at installation time. 3. That version may differ from the version originally tested or audited with the Skill. 4. Package build or installation code runs under the installing user's privileges. 5. The package is later imported by `server.py` and executes under the MCP server account. 6. If an upstream release is compromised ...[truncated 570 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `fastmcp` to a reviewed, exact version. 2. Generate a lockfile containing the complete transitive dependency graph. 3. Use hash verification, such as pip's `--require-hashes`, for production installation. 4. Review dependency release notes and security advisories before upgrades. 5. Perform upgrades through explicit, reviewed repository changes rather than resolving `latest` during deployment. 6. Remove Python packages from `package.json` dependencies unless a documented build mechanism actually consumes them. 7. Ensure `clawhub.json`, `package.json`, and `requirements.txt` describe the same dependency set. 8. Install dependencies in an isolated virtual environment under an unprivileged account. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (36)

Tainted flow: 'COMFY_CLOUD_API' from os.getenv (line 17, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

logger.debug(f"工作流数据: {workflow_json}")

    try:
        r = requests.post(
            f"{COMFY_CLOUD_API}/api/prompt",
            json={"prompt": workflow_json},
            headers=get_headers()

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'COMFY_CLOUD_API' from os.getenv (line 17, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

"type": output_type
    }

    response = requests.get(
        f"{COMFY_CLOUD_API}/api/view",
        headers={"X-API-Key": COMFY_CLOUD_API_KEY},
        params=params

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'COMFY_CLOUD_API' from os.getenv (line 17, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

Returns:
        dict: 任务状态信息
    """
    response = requests.get(
        f"{COMFY_CLOUD_API}/api/job/{prompt_id}/status",
        headers={"X-API-Key": COMFY_CLOUD_API_KEY}
    )

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The tool advertises that it downloads a video associated with a specific prompt_id, but the implementation never uses prompt_id in the download request and instead fetches by filename alone. This can cause incorrect object retrieval, cross-job data mixups, or unauthorized access to another user's output if filenames are guessable or reused, especially in a multi-tenant backend.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

result = r.json()
        prompt_id = result["prompt_id"]
        logger.info(f"工作流提交成功，prompt_id: {prompt_id}")
        return prompt_id
    except requests.exceptions.RequestException as e:
        logger.error(f"提交工作流到 ComfyUI 失败: {e}")
        raise

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The skill description and invocation examples are presented only in Chinese, which can constitute a language/locale policy issue when no user choice or opt-in is offered. There is no indication that the skill is intentionally limited to a Chinese-speaking region or that alternative languages are supported.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The usage section provides only Chinese prompts for activation and operation, which suggests the skill expects a specific language without documenting user choice. Under SQP-3, language constraints should be optional or clearly justified.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The natural-language instructions, headings, and usage guidance are presented exclusively in Chinese, and the file does not offer an alternative language or indicate that the skill is intentionally limited to a Chinese-speaking audience. Under SQP-3, forcing a specific language without user opt-in is a policy violation.

Known Vulnerable Dependency: requests==2.32.5 — 2 advisory(ies): CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func); CVE-2026-25645 (Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract)

Medium

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: `requests==2.32.5` is explicitly pinned to a version reported as affected by known advisories, so this is a concrete vulnerable dependency rather than a speculative one. Even if the vulnerable utility path is not always exercised, retaining a known-affected version in a network-facing skill increases attack surface and can become exploitable as code evolves or if transitive usage reaches the affected functionality.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstrings, comments, and user-facing descriptions are written entirely in Chinese, which can amount to a language policy violation when the skill does not provide any user opt-in or alternative locale. There is no indication that this tool is intentionally restricted to a Chinese-speaking or region-specific context.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The module and tool docstrings are written entirely in Chinese, which imposes a specific language on users without indicating any language-selection mechanism or opt-in. Under the stated policy, fixed language behavior can be a natural-language policy violation unless the locale constraint is documented and justified.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info(f"创建 ffmpeg 列表文件：{list_file}")

            logger.info("运行 ffmpeg 合成视频...")
            result = subprocess.run(
                ["ffmpeg", "-f", "concat", "-safe", "0", "-i", list_file, "-c", "copy", output_file],
                capture_output=True,
                text=True

• Confidence: 90% confidence
• Finding: The code invokes ffmpeg on user-influenced inputs without validating the provided file paths or constraining where inputs and outputs may point. Although it does not use shell=True, ffmpeg's concat demuxer with -safe 0 explicitly disables path safety checks and can process arbitrary paths, making this dangerous in an agent/tool context where untrusted users may cause access to unexpected local files, overwrite output locations, or abuse ffmpeg's broad file/protocol handling.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The module docstring and function docstring are entirely in Chinese, including user-facing descriptions and parameter documentation. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The tool sends the user-provided prompt and workflow data to an external ComfyUI service via submit_workflow(), which is a network/data-transmission operation. Although there is internal logging and a docstring describing video generation, this file does not include a user-facing warning that prompt content will be transmitted to another service.

External Transmission

Medium

• Category: Data Exfiltration

Content

logger.debug(f"工作流数据: {workflow_json}")

    try:
        r = requests.post(
            f"{COMFY_CLOUD_API}/api/prompt",
            json={"prompt": workflow_json},
            headers=get_headers()

• Confidence: 84% confidence
• Finding: This code explicitly sends workflow content to an external API. In an agent/skill context, that can expose sensitive user prompts, file references, or internal workflow logic to a third-party service if users are not clearly informed or if data minimization is not applied.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The module transmits workflow_json to a remote ComfyUI API, and the debug log indicates workflows may contain detailed prompt/workflow content. If workflows contain sensitive prompts, internal instructions, or user data, sending them off-box without clear disclosure or consent can create unintended data exposure and privacy/compliance risk.

Tainted flow: 'prompt_id' from requests.post (line 51, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

Returns:
        dict: 任务状态信息
    """
    response = requests.get(
        f"{COMFY_CLOUD_API}/api/job/{prompt_id}/status",
        headers={"X-API-Key": COMFY_CLOUD_API_KEY}
    )

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow saves generated output to a filesystem path derived from the prompt via `output/images/{prompt}.png` without any visible disclosure, sanitization, or indication of consent handling in this file. This can create privacy and security issues: prompts may contain sensitive user data that becomes embedded in filenames, and unsanitized prompt-derived paths can introduce filename/path manipulation risks depending on the runtime's templating behavior.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The text prompt is written entirely in Chinese, which imposes a specific language/locale in the skill behavior or example content. There is no indication that users can choose another language or that the workflow is intentionally restricted to a Chinese-language context.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This markdown file documents a file-affecting behavior ('一键下载生成的视频') but does not include any user warning about local file creation, overwrite behavior, or destination path. For markdown skills, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system state.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The README shows a direct command to download generated videos but provides no accompanying disclosure about writing files to disk. Users should be warned when a skill operation creates or modifies local data so they can understand the impact before invoking it.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The documentation instructs users to expose services on 0.0.0.0 and includes video download functionality, but it does not warn about the risks of network exposure, untrusted prompts, or handling generated/downloaded files. In a skill that operates an MCP server and downloads artifacts, missing safety guidance can lead to inadvertent exposure of local services or unsafe handling of files fetched from another service.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The manifest description is written entirely in Chinese, which imposes a specific language choice in user-facing metadata without indicating that other languages are supported. This matches the policy category for language or locale constraints that are not offered as an opt-in.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "python": ">=3.10",
    "fastmcp": "latest",
    "requests": "latest"
  },
  "peerDependencies": {

• Confidence: 95% confidence
• Finding: Using the version specifier "latest" for fastmcp causes installs to resolve to whatever version is current at install time, making builds non-reproducible and increasing supply-chain risk. A malicious or compromised upstream release could be pulled in automatically without review, which is more concerning here because this skill starts a network-accessible server and likely processes untrusted inputs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "python": ">=3.10",
    "fastmcp": "latest",
    "requests": "latest"
  },
  "peerDependencies": {
    "comfyui": ">=1.0.0"

• Confidence: 95% confidence
• Finding: Using "latest" for requests introduces the same supply-chain and reproducibility problem: each installation may fetch a different dependency version, including a newly introduced vulnerable or malicious release. Because this skill appears to act as an HTTP-facing service and may make outbound requests, compromise of a core HTTP library could affect confidentiality, integrity, or availability.

Static analysis

No suspicious patterns detected.