ComfyUI Painter

• Analyzed: May 11, 2026, 4:51 AM
• Findings: 1
• Version: 2.0.0
• Hash: c9cab9455ec26039ca60815ed6d664e0ba9382530d480640b05f484613f351c1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is suspicious due to a critical path traversal vulnerability in `scripts/civitai.py`. The `download_model` function uses `os.path.join` with a user-controlled `filename` parameter without sanitization, allowing an attacker to write arbitrary files to arbitrary locations on the filesystem (e.g., `../../../../tmp/malicious.sh`). If the download URL can also be controlled by the agent based on user input, this constitutes a Remote Code Execution (RCE) risk. Other shell executions via PowerShell and `curl` are present but appear to be used for legitimate purposes, though they could be exploited if `config.json` were compromised via another vulnerability.