ClawHub
Back to skill

Security audit

Comfyui Mcp Skill

Security checks for vulnerabilities and agentic risk

Overview

This video-generation skill is mostly purpose-aligned, but it exposes powerful unauthenticated network tools and under-discloses cloud prompt transmission and broad local file access.

Review before installing. Use stdio or bind only to 127.0.0.1, put any HTTP deployment behind authentication and firewalling, run it as an unprivileged user in an isolated workspace, and avoid sensitive prompts unless you explicitly intend to send them to the configured cloud endpoint. The file download and FFmpeg tools should be patched to confine all paths before use in a shared or network-reachable environment.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

other

Error
Location
utils/comfy_client.py:17
Finding

Undisclosed transmission of user prompts and workflows to an external cloud service

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
tools/download_video.py:16
Finding

Arbitrary filesystem write through attacker-controlled download paths

Content
View full analysis
str: """ Download the video associated with a prompt ID. """ os.makedirs(output_dir, exist_ok=True) if not filename: filename = f"{prompt_id}.mp4" try: data = download_output(filename, "", "output") output_path = os.path.join(output_dir, filename) with open(output_path, "wb") as f: f.write(data) logger.info(f"Video saved to: {output_path}") return output_path except Exception as e: logger.error(f"Video download failed: {e}") raise ``` ### Technical Analysis Both `output_dir` and `filename` are directly controlled by an MCP caller. The implementation creates the supplied directory and opens the joined path without canonicalization or confinement to a dedicated output directory. The following path forms are accepted: - Absolute `output_dir` values. - Absolute `filename` values, which can override the joined directory. - Relative traversal components such as `../../`. - Symlinked destination directories or files. When no explicit filename is supplied, the attacker-controlled `prompt_id` is incorporated into the filename, providing another traversal source. The bytes written to disk come from the configured remote API. Consequently, an attacker who can invoke the tool and influence which remote object is returned can place remote content at any path writable by the MCP server account. ### Attack Path 1. An attacker obtains access to the MCP endpoint. 2. The attacker invokes `download_video` with an attacker-selected destination, such as an absolute path or a path containing `../`. 3. `os.makedirs` creates the selected directory where permissions ...[truncated 974 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
tools/compose_video.py:15
Finding

Unsafe arbitrary-path FFmpeg processing and insecure temporary manifest

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
server.py:21
Finding

Unauthenticated MCP service binds to all network interfaces by default

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned executable dependencies create supply-chain and reproducibility risk

Content
View full analysis
=3.10", "fastmcp": "latest", "requests": "latest" } ``` ### Technical Analysis `fastmcp` is installed without a version constraint in `requirements.txt`, while `package.json` describes `fastmcp` and `requests` as `latest`. This causes installations at different times to resolve to different code that has not necessarily been reviewed with the Skill. Python package installation may execute package build-system code, and imported dependencies execute with the privileges of the Skill process. A compromised upstream release, hijacked maintainer account, or unexpectedly incompatible future release could therefore alter installation or runtime behavior. The `package.json` declarations are also misleading because they describe Python packages as Node dependencies. Even if they are not used by the documented `pip` installation path, mutable and inconsistent declarations make dependency review and reproducibility harder. No evidence was found that the currently named packages are typosquatted or intentionally malicious. The confirmed issue is the unsafe mutable dependency policy. ### Attack Path 1. A user follows the installation instructions and runs `pip install -r requirements.txt`. 2. The resolver selects whatever `fastmcp` version is current at installation time. 3. That version may differ from the version originally tested or audited with the Skill. 4. Package build or installation code runs under the installing user's privileges. 5. The package is later imported by `server.py` and executes under the MCP server account. 6. If an upstream release is compromised ...[truncated 570 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (36)

Tainted flow: 'COMFY_CLOUD_API' from os.getenv (line 17, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · utils/comfy_client.py (reported line 44)May include surrounding context.

python
logger.debug(f"工作流数据: {workflow_json}")

    try:
        r = requests.post(
            f"{COMFY_CLOUD_API}/api/prompt",
            json={"prompt": workflow_json},
            headers=get_headers()

Tainted flow: 'COMFY_CLOUD_API' from os.getenv (line 17, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · utils/comfy_client.py (reported line 79)May include surrounding context.

python
"type": output_type
    }

    response = requests.get(
        f"{COMFY_CLOUD_API}/api/view",
        headers={"X-API-Key": COMFY_CLOUD_API_KEY},
        params=params

Tainted flow: 'COMFY_CLOUD_API' from os.getenv (line 17, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · utils/comfy_client.py (reported line 98)May include surrounding context.

python
Returns:
        dict: 任务状态信息
    """
    response = requests.get(
        f"{COMFY_CLOUD_API}/api/job/{prompt_id}/status",
        headers={"X-API-Key": COMFY_CLOUD_API_KEY}
    )

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The tool advertises that it downloads a video associated with a specific prompt_id, but the implementation never uses prompt_id in the download request and instead fetches by filename alone. This can cause incorrect object retrieval, cross-job data mixups, or unauthorized access to another user's output if filenames are guessable or reused, especially in a multi-tenant backend.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · utils/comfy_client.py (reported line 53)May include surrounding context.

python
result = r.json()
        prompt_id = result["prompt_id"]
        logger.info(f"工作流提交成功，prompt_id: {prompt_id}")
        return prompt_id
    except requests.exceptions.RequestException as e:
        logger.error(f"提交工作流到 ComfyUI 失败: {e}")
        raise

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill description and invocation examples are presented only in Chinese, which can constitute a language/locale policy issue when no user choice or opt-in is offered. There is no indication that the skill is intentionally limited to a Chinese-speaking region or that alternative languages are supported.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The usage section provides only Chinese prompts for activation and operation, which suggests the skill expects a specific language without documenting user choice. Under SQP-3, language constraints should be optional or clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The natural-language instructions, headings, and usage guidance are presented exclusively in Chinese, and the file does not offer an alternative language or indicate that the skill is intentionally limited to a Chinese-speaking audience. Under SQP-3, forcing a specific language without user opt-in is a policy violation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: requests==2.32.5 — 2 advisory(ies): CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func); CVE-2026-25645 (Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract)

Medium
Category
Supply Chain
Confidence
91% confidence
Finding

requests==2.32.5 is explicitly pinned to a version reported as affected by known advisories, so this is a concrete vulnerable dependency rather than a speculative one. Even if the vulnerable utility path is not always exercised, retaining a known-affected version in a network-facing skill increases attack surface and can become exploitable as code evolves or if transitive usage reaches the affected functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstrings, comments, and user-facing descriptions are written entirely in Chinese, which can amount to a language policy violation when the skill does not provide any user opt-in or alternative locale. There is no indication that this tool is intentionally restricted to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module and tool docstrings are written entirely in Chinese, which imposes a specific language on users without indicating any language-selection mechanism or opt-in. Under the stated policy, fixed language behavior can be a natural-language policy violation unless the locale constraint is documented and justified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

The code invokes ffmpeg on user-influenced inputs without validating the provided file paths or constraining where inputs and outputs may point. Although it does not use shell=True, ffmpeg's concat demuxer with -safe 0 explicitly disables path safety checks and can process arbitrary paths, making this dangerous in an agent/tool context where untrusted users may cause access to unexpected local files, overwrite output locations, or abuse ffmpeg's broad file/protocol handling.

Content

Scanner excerpt · tools/compose_video.py (reported line 43)May include surrounding context.

python
logger.info(f"创建 ffmpeg 列表文件：{list_file}")

            logger.info("运行 ffmpeg 合成视频...")
            result = subprocess.run(
                ["ffmpeg", "-f", "concat", "-safe", "0", "-i", list_file, "-c", "copy", output_file],
                capture_output=True,
                text=True

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring and function docstring are entirely in Chinese, including user-facing descriptions and parameter documentation. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The tool sends the user-provided prompt and workflow data to an external ComfyUI service via submit_workflow(), which is a network/data-transmission operation. Although there is internal logging and a docstring describing video generation, this file does not include a user-facing warning that prompt content will be transmitted to another service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This code explicitly sends workflow content to an external API. In an agent/skill context, that can expose sensitive user prompts, file references, or internal workflow logic to a third-party service if users are not clearly informed or if data minimization is not applied.

Content

Scanner excerpt · utils/comfy_client.py (reported line 44)May include surrounding context.

python
logger.debug(f"工作流数据: {workflow_json}")

    try:
        r = requests.post(
            f"{COMFY_CLOUD_API}/api/prompt",
            json={"prompt": workflow_json},
            headers=get_headers()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module transmits workflow_json to a remote ComfyUI API, and the debug log indicates workflows may contain detailed prompt/workflow content. If workflows contain sensitive prompts, internal instructions, or user data, sending them off-box without clear disclosure or consent can create unintended data exposure and privacy/compliance risk.

Content

No source excerpt is available for this finding.

Tainted flow: 'prompt_id' from requests.post (line 51, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · utils/comfy_client.py (reported line 98)May include surrounding context.

python
Returns:
        dict: 任务状态信息
    """
    response = requests.get(
        f"{COMFY_CLOUD_API}/api/job/{prompt_id}/status",
        headers={"X-API-Key": COMFY_CLOUD_API_KEY}
    )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The workflow saves generated output to a filesystem path derived from the prompt via output/images/{prompt}.png without any visible disclosure, sanitization, or indication of consent handling in this file. This can create privacy and security issues: prompts may contain sensitive user data that becomes embedded in filenames, and unsanitized prompt-derived paths can introduce filename/path manipulation risks depending on the runtime's templating behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The text prompt is written entirely in Chinese, which imposes a specific language/locale in the skill behavior or example content. There is no indication that users can choose another language or that the workflow is intentionally restricted to a Chinese-language context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file documents a file-affecting behavior ('一键下载生成的视频') but does not include any user warning about local file creation, overwrite behavior, or destination path. For markdown skills, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README shows a direct command to download generated videos but provides no accompanying disclosure about writing files to disk. Users should be warned when a skill operation creates or modifies local data so they can understand the impact before invoking it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation instructs users to expose services on 0.0.0.0 and includes video download functionality, but it does not warn about the risks of network exposure, untrusted prompts, or handling generated/downloaded files. In a skill that operates an MCP server and downloads artifacts, missing safety guidance can lead to inadvertent exposure of local services or unsafe handling of files fetched from another service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description is written entirely in Chinese, which imposes a specific language choice in user-facing metadata without indicating that other languages are supported. This matches the policy category for language or locale constraints that are not offered as an opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Using the version specifier "latest" for fastmcp causes installs to resolve to whatever version is current at install time, making builds non-reproducible and increasing supply-chain risk. A malicious or compromised upstream release could be pulled in automatically without review, which is more concerning here because this skill starts a network-accessible server and likely processes untrusted inputs.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json
},
  "dependencies": {
    "python": ">=3.10",
    "fastmcp": "latest",
    "requests": "latest"
  },
  "peerDependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Using "latest" for requests introduces the same supply-chain and reproducibility problem: each installation may fetch a different dependency version, including a newly introduced vulnerable or malicious release. Because this skill appears to act as an HTTP-facing service and may make outbound requests, compromise of a core HTTP library could affect confidentiality, integrity, or availability.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json
"dependencies": {
    "python": ">=3.10",
    "fastmcp": "latest",
    "requests": "latest"
  },
  "peerDependencies": {
    "comfyui": ">=1.0.0"

Static analysis

No suspicious patterns detected.