ComfyUI Painter

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:57 AM UTC
• Version: 2.0.0

Overview

This skill is mostly a local ComfyUI/CivitAI automation tool, but it gives chat-triggered workflows broad local process, network, credential, and file-write authority without enough scoping or safeguards.

Review before installing. Use this only in a controlled local environment, remove the catch-all Discord trigger, make Discord posting opt-in, bind ComfyUI to localhost, replace the all-python shutdown with PID-scoped shutdown, and harden CivitAI downloads so tokens are sent only to approved CivitAI hosts and files cannot be written outside the intended model directory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/civitai.py:284

Finding

CivitAI Bearer Token Can Be Disclosed to an Arbitrary Download Host

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/civitai.py:287

Finding

Model Download Filename Allows Writes Outside the Checkpoint Directory

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/comfyui_manager.py:45

Finding

ComfyUI Shutdown Forcefully Terminates All Windows Python Processes

Content

View full analysis

bool: subprocess.run( [POWERSHELL, "-Command", "Get-Process python -ErrorAction SilentlyContinue | Stop-Process -Force"], capture_output=True, timeout=10 ) time.sleep(1) return not is_running() ``` The automatic caller is present in `scripts/auto_shutdown.py`, lines 18-30: ```python if not LAST_USED.exists(): # 没有记录，执行关闭 stop() return "shutdown_no_record" last_ts = float(LAST_USED.read_text().strip()) elapsed_min = (time.time() - last_ts) / 60 if elapsed_min >= TIMEOUT_MIN: stop() LAST_USED.unlink(missing_ok=True) return f"shutdown_idle_{elapsed_min:.0f}min" ``` ### Technical Analysis The Skill starts a specific ComfyUI Python process but does not capture or persist its process identifier. Its shutdown method instead retrieves every Windows process named `python` and sends each one a forced termination request. This is significantly broader than the permission needed to manage the ComfyUI process. Process names are not unique security identifiers, and unrelated development tools, automation jobs, notebooks, servers, or background applications may use the same executable name. The risk is amplified by the declared heartbeat integration. `auto_shutdown.py` calls `stop()` automatically when the usage marker is stale and also when the marker does not exist. Therefore, unrelated process termination can occur without an explicit shutdown request from the user. ### Attack Path 1. One or more unrelated Windows Python applications are running alongside ComfyUI. 2. The `.last_used` marker is missing or becomes older than the configured timeout. 3. A heartbeat or user action invokes `auto_shutdown.py`. 4. `auto_shutdown.py` calls `comfyui_manager.stop()`. 5. P ...[truncated 948 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/comfyui_manager.py:24

Finding

ComfyUI API Is Bound to All Network Interfaces Without Access Controls

Content

View full analysis

bool: if is_running(): _touch() return True cmd = ( f"Start-Process -FilePath '{COMFY['python_path']}' " f"-ArgumentList '{COMFY['main_path']}','--listen','0.0.0.0','--port','{COMFY['port']}' " f"-WorkingDirectory '{COMFY['work_dir']}' -WindowStyle Hidden" ) subprocess.run([POWERSHELL, "-Command", cmd], capture_output=True, timeout=15) ``` ### Technical Analysis The Skill communicates with ComfyUI through the locally configured URL `http://localhost:8188`, but startup passes `--listen 0.0.0.0`. This directs ComfyUI to accept connections on every available network interface rather than only the loopback interface. The audited project does not configure authentication, TLS, a firewall allowlist, or an authenticated reverse proxy. As a result, network peers able to reach port 8188 may directly access the ComfyUI API. The exposure exceeds the minimum privilege needed for the declared workflow because all requests made by the Skill itself are local. Binding to loopback would satisfy the documented local generation use case. ### Attack Path 1. The Skill starts ComfyUI with `--listen 0.0.0.0 --port 8188`. 2. The host firewall or surrounding network permits another device to connect to port 8188. 3. A network peer discovers or is given the endpoint. 4. The peer submits unauthenticated ComfyUI API requests. 5. The peer consumes GPU and system resources or accesses capabilities exposed by the installed ComfyUI configuration and custom nodes. The exact operations available depend on the deployed ComfyUI version and installed nodes, but unauthenticated API reachability is established by the startup configuration. ### Impact Assessment Potential effects include: - Unauthori ...[truncated 509 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/comfyui_manager.py:27

Finding

Unescaped Configuration Values Are Interpolated into a PowerShell Command

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (32)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger conditions are so broad that any message in the designated Discord art channel activates the skill, even when the user did not intend to start local generation or model operations. This increases the chance of unauthorized or accidental execution of resource-intensive actions and can be abused to repeatedly start workloads.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

声明描述覆盖了较广的功能：ComfyUI 画图工作流 + CivitAI 集成，包含模型搜索/下载/更新检查/自动调参，以及文生图/图生视频。提供的代码片段只包含一个生成脚本：读取配置，构建 ComfyUI prompt，调用本地 API /api/prompt 和 /api/queue，等待任务完成后从本地输出目录获取最新 PNG 图片。它没有任何与 CivitAI 相关的网络请求、搜索、下载、模型更新检查代码，也没有视频生成或图生视频流程；也未看到真正的自动参数优化逻辑。虽然“本地 ComfyUI 生成图片”这一部分与声明部分吻合，但整体声明显著高于代码实际行为，因此属于描述与行为不一致，且主要是过度声明功能。

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The activation rules include broad keyword triggers and a catch-all condition for any message in a Discord art channel, which can cause the skill to run on unrelated or accidental messages. In this skill's context, unintended invocation is more dangerous because execution may start local services, generate content, download models, or send outputs externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow states that generated images are sent to a specific Discord channel, but the description does not prominently warn users that outputs will be transmitted off the local machine. Because image prompts and outputs may contain sensitive, personal, or NSFW content, automatic posting creates a substantial privacy and compliance risk if users expect purely local generation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The stop behavior kills every Python process on the machine, which is substantially broader than 'control local ComfyUI' and can cause denial of service against unrelated software. Because this is a local agent skill intended for routine image generation, users are unlikely to expect or consent to host-wide termination of Python workloads.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate.py (reported line 100)May include surrounding context.

python

},
    }

    return prompt


def submit(prompt: dict) -> str:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The file presents the skill specification and user-facing trigger guidance entirely in Chinese, including operational expectations for invocation. This can constitute a language policy issue when the skill appears intended for broader use but does not offer user language choice or explain that it is restricted to a Chinese-speaking environment.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · DESIGN.md (reported line 49)May include surrounding context.

python

import json, urllib.request
data = json.dumps({"prompt": prompt_dict}).encode()
req = urllib.request.Request("http://localhost:8188/api/prompt", data=data, headers={"Content-Type": "application/json"})
resp = urllib.request.urlopen(req)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The shutdown command Get-Process python ... | Stop-Process -Force indiscriminately kills all Python processes on the host, far exceeding the skill’s intended scope of managing a single ComfyUI instance. In this environment, that could terminate unrelated services, developer jobs, bots, or security tooling, causing denial of service and possible data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The design allows automatic start and stop of a local process without any user-facing notice or confirmation. Silent process management can surprise users, consume local GPU/CPU resources, and make it easier for a remote chat message to manipulate host state without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The design says generated images are automatically sent to Discord but does not warn users that prompts and outputs will be posted to a channel. That creates privacy and content-disclosure risk, especially if users assume generation is local/private or include sensitive prompts or images.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares executable behaviors spanning shell, network, file read/write, and environment access, but provides no explicit tool scope or permission boundary. That makes the effective privilege set ambiguous and increases the chance the agent can start processes, download files, and modify local state without clear user consent or policy enforcement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The manifest description and operational instructions are written as if the skill is intended for Chinese-language triggering and channel use, with no indication that users may choose another language. This can be a language/locale policy issue when a skill effectively constrains interaction language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises CivitAI integration including download and config update operations but does not surface a prominent warning that it may retrieve remote model files and modify local configuration. Remote downloads and automatic local changes materially affect system integrity and storage, and users may not realize those side effects from the top-level description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code performs safety-relevant actions by stopping ComfyUI and deleting the .last_used file, but there is no confirmation prompt, no warning log before the action, and no explanatory comment describing user impact beyond internal control-flow notes. For a code file, these operations qualify as destructive or state-changing behavior that should include some form of user disclosure.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/civitai.py (reported line 50)May include surrounding context.

python

return os.environ.get("CIVITAI_API_KEY", "")


def _api_get(endpoint, params=None, use_auth=False):
    """Make a GET request to CivitAI API using curl (more reliable than urllib).
    """
    url = f"{API_BASE}/{endpoint}"

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/civitai.py (reported line 65)May include surrounding context.

python

cmd.append(url)
    
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=20)
    if result.returncode != 0:
        raise RuntimeError(f"curl failed: {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/civitai.py (reported line 156)May include surrounding context.

python

def get_autov2_hash(filepath):
    """Compute AutoV2 hash (first 10 chars of SHA256, uppercase) for a model file."""
    result = subprocess.run(
        ["sha256sum", filepath],
        capture_output=True, text=True, timeout=300
    )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The function places downloaded model artifacts directly into ComfyUI's checkpoints directory without an approval gate, quarantine step, or safety warning. In this skill's image-generation context, that is more dangerous than a generic file download because the downloaded artifact is likely to be consumed automatically or semi-automatically by a local ML toolchain, increasing the chance of executing or trusting unreviewed third-party content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 83% confidence

Finding

This code downloads attacker-controlled remote content and writes it directly to the local model directory using a URL that may come from user input or remote API data, with no allowlist, content validation, size check, or integrity verification. In the ComfyUI context, model files are high-risk artifacts because loading untrusted models can lead to downstream code execution or compromise through deserialization or plugin/model handling bugs.

Content

Scanner excerpt · scripts/civitai.py (reported line 305)May include surrounding context.

python

cmd.append(url)
    
    print(f"Downloading to {dest}...", file=sys.stderr)
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=1800)
    
    if result.returncode != 0:
        raise RuntimeError(f"Download failed: {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/comfyui_manager.py (reported line 35)May include surrounding context.

python

f"-ArgumentList '{COMFY['main_path']}','--listen','0.0.0.0','--port','{COMFY['port']}' "
        f"-WorkingDirectory '{COMFY['work_dir']}' -WindowStyle Hidden"
    )
    subprocess.run([POWERSHELL, "-Command", cmd], capture_output=True, timeout=15)
    
    # 等待启动
    for _ in range(timeout // 2):

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes host-level process-control via PowerShell, including forceful termination capability, which expands privilege and operational scope beyond simple image-generation API integration. In this skill context, such capability is more dangerous because it can affect the broader system, not just the local ComfyUI service the user expects to control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Force-stopping processes without any warning or confirmation increases the likelihood of accidental disruption and data loss, especially since the command affects all Python processes rather than a single managed service. In an agent-operated skill, silent destructive behavior is particularly risky because users may invoke 'stop' expecting a narrow, reversible action.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This subprocess call forcefully terminates all Python processes on the host, not just the ComfyUI instance managed by this skill. In a local automation context, that can disrupt unrelated applications, developer tools, agents, or security services, making the behavior far broader and more dangerous than the skill description suggests.

Content

Scanner excerpt · scripts/comfyui_manager.py (reported line 47)May include surrounding context.

python

def stop() -> bool:
    subprocess.run(
        [POWERSHELL, "-Command",
         "Get-Process python -ErrorAction SilentlyContinue | Stop-Process -Force"],
        capture_output=True, timeout=10

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The submit function sends the user-provided prompt content to a remote/local HTTP API via urllib without any visible confirmation prompt, print/log disclosure, or warning comment/docstring indicating that prompt text will be transmitted. Because this is a code file and the operation involves network transmission of user data, it meets the missing-warning criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.