Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Comfyui Workflow

Universal ComfyUI workflow executor with 33+ workflow templates. Self-describing — use --inspect on ANY workflow to discover inputs and outputs automatically...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
2 · 336 · 0 current installs · 0 all-time installs
byYiqi Liu@yiqiliu2
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The name/description claim a universal ComfyUI workflow executor; the repo contains a CLI wrapper (comfy_run.py), an API/WebSocket client (comfy_api.py), and many workflow JSONs. Declared requirements (Python 3.10+, websocket-client, requests, a running ComfyUI server, optional token) match the stated purpose and nothing extraneous (no cloud credentials, unrelated binaries, or unusual config paths) is requested.
Instruction Scope
SKILL.md confines runtime activity to converting workflow JSON → ComfyUI API payloads, uploading local input files, monitoring execution over a WebSocket to the COMFY_HOST, and downloading outputs to a local output directory. It instructs agents to update local caches (MODELS_INVENTORY.md, WORKFLOWS_SUMMARY.md) with the user's environment — this is expected for a local executor but is persistent file writing and should be noted. There are no instructions to contact external endpoints beyond the configured ComfyUI host.
Install Mechanism
There is no install spec; this is instruction+script based. Dependencies are standard Python packages (websocket-client, requests) recommended by SKILL.md. No archive downloads or external install URLs are used by the skill files provided.
Credentials
The skill requests no required environment variables or credentials by default. COMFY_HOST and a ComfyUI Token are optional and clearly documented; those are proportionate for connecting to an authenticated ComfyUI server. No unrelated secrets or multiple external-service tokens are asked for.
Persistence & Privilege
always:false (normal). The SKILL.md explicitly encourages updating MODELS_INVENTORY.md and WORKFLOWS_SUMMARY.md as a local knowledge cache — this creates persistent files under the skill directory. That persistence is expected for this use case but users should be aware the agent is instructed to write/update local files.
Assessment
This skill appears to be what it says: a local ComfyUI workflow executor. Before installing or running it: 1) Ensure COMFY_HOST points to a ComfyUI server you control or trust (the skill will connect to whatever host you configure). 2) Only provide a ComfyUI token if the server requires authentication; tokens are scoped to that server — do not reuse unrelated secrets. 3) Inspect the included scripts (scripts/comfy_run.py and scripts/comfy_api.py) yourself — they are present in the bundle and implement the network calls; confirm there are no unexpected external hosts in their code. 4) Use --dry-run or --inspect first (as the README suggests) to preview the API payload before executing. 5) Be aware the skill writes/updates MODELS_INVENTORY.md and WORKFLOWS_SUMMARY.md as a local knowledge cache — if you don't want persistent changes, run in a disposable/sandbox directory or back up those files first. 6) If you want extra caution, run the skill in an isolated environment (container or VM) so GPU/model loading and file writes are contained.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.1.0
Download zip
latestvk97bhs92jd935j6c4q3r8nv8j98210xm

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

ComfyUI Workflows — Agent Usage Guide

⚠️ READ-ONLY WARNING: The scripts in this skill (comfy_run.py, comfy_api.py) are production-validated and must not be modified. They handle 33+ workflow JSONs with complex LiteGraph→API conversion, subgraph expansion, bypass resolution, and multi-format output downloading. Any modification risks breaking all workflows. Only read and use the scripts — never edit them.


Requirements

Before using this skill, ensure your environment meets these requirements:

RequirementDetails
Python3.10 or higher
pip packageswebsocket-client, requests
ComfyUI serverMust be running before executing workflows
TokenRequired if ComfyUI has authentication enabled

Install Python dependencies:

pip install websocket-client requests

Configuration Options

VariableDescriptionDefault
COMFY_HOSTComfyUI server address127.0.0.1:8188
COMFY_WORKFLOW_DIRSAdditional workflow directories(none)

Credentials

CredentialRequiredSource
ComfyUI TokenOnly if auth enabledComfyUI settings page

Personal Configuration Required

Before using this skill, ensure these items are configured for your environment:

ItemDescriptionWhere to Configure
comfy_hostYour ComfyUI server addressscripts/config.json or COMFY_HOST env
ComfyUI serverMust be running before executing workflowsStart manually
Model pathsYour local model directoriesMODELS_INVENTORY.md (for reference)
TokenComfyUI authentication tokenGet from ComfyUI settings
Workflow filesYour own workflow JSON filesworkflows/ directory (see note below)

Quick Setup

1. Start ComfyUI

Start your ComfyUI server manually before executing any workflows. The skill expects ComfyUI to be running at the configured host.

2. Configure Connection

Create scripts/config.json:

{
  "comfy_host": "127.0.0.1:8188",
  "workflow_dirs": []
}

Or set environment variables:

export COMFY_HOST="127.0.0.1:8188"

3. Install Dependencies

pip install websocket-client requests

4. Add Your Workflows

Place workflow JSON files in workflows/ directory, organized by category:

workflows/
├── Image-Text/
│   ├── workflow1.json
│   └── workflow2.json
├── Image-Edit/
│   └── ...
└── Video/
    └── ...

Shell Variables (use in all commands)

VENV=python3  # or path to your venv
SCRIPT=/path/to/comfyui-workflow-skill/scripts/comfy_run.py

End-to-End Workflow (Steps 0–5)

Step 0 — Ensure ComfyUI Is Running

Start ComfyUI manually. Verify it's accessible at http://127.0.0.1:8188.

Step 1 — List Available Workflows

$VENV $SCRIPT --list

Step 2 — Inspect the Workflow

$VENV $SCRIPT -w "workflow_name" --inspect

Step 3 — Prepare Inputs

--prompt "your prompt"           # Text prompts
--image /path/to/image.jpg       # Image inputs
--audio /path/to/audio.wav       # Audio inputs
--video /path/to/video.mp4       # Video inputs
--width 1024 --height 1024       # Resolution
--steps 50 --cfg 4.0 --seed 42   # Sampler settings
--override '{"node_id": {"key": value}}'  # Advanced overrides

Step 4 — Execute

$VENV $SCRIPT -w "workflow_name" --prompt "..." -o /tmp

Step 5 — Collect Outputs

Outputs are saved to the -o directory with auto-generated prefixes.


CLI Reference

Usage: comfy_run.py [-w WORKFLOW] [options]

Modes:
  --list              List all available workflows
  --inspect           Human-readable input/output inspection
  --inspect-json      Machine-readable JSON inspection
  --dry-run           Print API JSON without executing
  --queue             Submit to queue and return immediately
  --status [IDs...]   Check queue state

Input customization:
  --prompt, -p TEXT        Positive prompt
  --negative, -n TEXT      Negative prompt
  --image, -i PATH [...]   Input image(s)
  --audio, -a PATH [...]   Input audio file(s)
  --video, -v PATH [...]   Input video file(s)

Generation settings:
  --width, -W INT          Output width
  --height, -H INT         Output height
  --steps INT              Sampling steps
  --cfg FLOAT              CFG scale
  --seed INT               Random seed

Advanced:
  --override JSON          Node input overrides
  --config PATH            YAML/JSON config file
  --server HOST:PORT       ComfyUI server
  --output-dir, -o PATH    Output directory
  --output-prefix TEXT     Output filename prefix
  --no-ensure              Skip auto-starting ComfyUI
  --no-validate            Skip input validation

Troubleshooting

ProblemFix
Workflow not foundUse --list to see available workflows
NO OUTPUTS generatedRun --inspect to check required inputs
Cannot reach ComfyUIEnsure ComfyUI is running at configured host
Image file not foundUse absolute paths, verify with ls -la
GPU out of memoryReduce resolution or steps

Knowledge Cache Pattern

MODELS_INVENTORY.md and WORKFLOWS_SUMMARY.md serve as the agent's persistent knowledge base for the user's actual ComfyUI setup. Use them to cache learned information across sessions:

⚠️ DO NOT REFERENCE THE EXAMPLE CONTENT: The default content in these files describes sanitized example workflows that will NOT work. Agents MUST update them with the user's actual data before relying on them. Using outdated example data will cause workflow failures.

Initial Setup (First Time)

When the user first provides their own workflow files:

  1. Clean the example content — Remove the sanitized example entries from both files
  2. Populate with user's data — Run --inspect on each workflow, document findings in WORKFLOWS_SUMMARY.md
  3. Inventory models — Scan user's model directories, update MODELS_INVENTORY.md with their actual models

Ongoing Maintenance

  • After using a new workflow → Add its documentation to WORKFLOWS_SUMMARY.md
  • After downloading models → Update MODELS_INVENTORY.md status
  • When learning model-specific quirks → Document tips/tricks in the relevant section

Session Workflow

1. Read MODELS_INVENTORY.md → know available models
2. Read WORKFLOWS_SUMMARY.md → know workflow capabilities
3. Select appropriate workflow without re-inspecting
4. If new workflow discovered → document it for future sessions

This pattern lets the agent skip repeated discovery and work efficiently with cached knowledge.


Reference Documents

DocumentPurpose
MODELS_INVENTORY.mdKnowledge cache — user's installed models, status, paths
WORKFLOWS_SUMMARY.mdKnowledge cache — workflow capabilities, settings, tips
references/prompting-guide.mdPrompt anatomy, model-specific strategies
references/maintenance.mdCode structure, debugging
references/architecture.mdDesign principles

Files

23 total
Select a file
Select a file to preview.

Comments

Loading comments…