Comfy UI Complete Toolkit
v1.0.0Portable ComfyUI workflow and API guidance for any install. Use when building, validating, or troubleshooting ComfyUI image/video workflows, discovering avai...
⭐ 0· 145·0 current·0 all-time
by@zambav
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match the runtime instructions: the SKILL.md consistently focuses on discovering a target ComfyUI install (via /object_info, /queue, /history, /prompt, /ws) and building/validating workflows. There are no unrelated requirements (no cloud creds, no system paths) and the manifest explicitly avoids machine-specific inventories.
Instruction Scope
Runtime instructions confine activity to querying the ComfyUI API, validating discovered node/model dropdown values, and building/submitting workflow JSON. The skill explicitly disallows embedding absolute filesystem paths or storing secrets in docs and instructs to ask the user for base URLs when unknown. It does not instruct reading arbitrary system files or environment variables outside the declared (none) set.
Install Mechanism
This is instruction-only with no install spec and no code files to write or execute. That is the lowest-risk install profile and matches the described portable guidance role.
Credentials
The skill declares no required environment variables, credentials, or config paths. It asks the user (or discovers) only for target ComfyUI base/websocket URLs and model names — which are appropriate and proportionate for the stated functionality.
Persistence & Privilege
always is false and the skill does not request persistent or cross-skill privileges. disable-model-invocation is the default (false) which is expected; nothing in the files suggests it would modify other skills or system settings.
Assessment
This skill appears coherent and portable. Before installing or using it, be sure you intentionally grant the agent access to the ComfyUI target you want it to manage: verify the base_url/websocket URL you provide (don’t hand over credentials or URLs for systems you don’t control), limit network exposure if possible (e.g., avoid giving access to internal-only services unless you trust the agent), and review any workflow submissions before approving large or expensive runs. If you need the agent to persist configuration, confirm that it will store that config in a user-owned location rather than a shared/global store.Like a lobster shell, security has layers — review code before you run it.
latestvk97fj9qr58gt8r5e939720qq4d83rby3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.