comfyui-skill-openclaw
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system commands to manage the ComfyUI environment and its own execution.
- Uses
subprocess.runto callgit cloneandpip installfor installing ComfyUI custom nodes (found inui/dependency_installer.py). - Uses
subprocess.runto bridge Web UI actions to thecomfyui-skillCLI (found inui/app.py). - Uses
os.execvinscripts/shared/updater.pyto restart the server process after a system update. - [EXTERNAL_DOWNLOADS]: The skill communicates with external services to fetch configurations and updates.
- Downloads ComfyUI node mapping data from
raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager(found inui/dependency_registry.py). - Fetches and downloads pre-built frontend assets from the author's GitHub repository (
HuangYuChuh/ComfyUI_Skills_OpenClaw-frontend) to perform UI updates (found inscripts/shared/frontend_update.py). - [SAFE]: The skill implements security controls to protect the host environment.
- In
ui/services.py, theget_workflow_history_image_pathfunction validates that requested image paths are within the authorized output directory, preventing directory traversal attacks. - Sensitive configurations like authentication tokens and API keys are managed through a
config.jsonfile rather than being hardcoded.
Audit Metadata