comfyui-video-production

Warn

Audited by Gen Agent Trust Hub on Mar 19, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python's subprocess module and PowerShell/Bash scripts to execute various system commands, including ffmpeg, ffprobe, nvidia-smi, and python main.py. These operations are used for video concatenation, metadata extraction, and starting ComfyUI instances.
  • [COMMAND_EXECUTION]: The instance management module uses the psutil library to identify and terminate processes listening on specific ports. This allows the skill to restart ComfyUI instances but involves process-level manipulation.
  • [REMOTE_CODE_EXECUTION]: The evaluation script eval/run-eval.sh executes the claude CLI tool with dynamically generated prompts. This constitutes execution of an external tool with content derived from test cases.
  • [PROMPT_INJECTION]: The skill interpolates user-provided prompts into video generation workflows. This creates an indirect prompt injection surface where malicious instructions embedded in data could influence the agent's actions or the behavior of the integrated tools.
  • Ingestion points: User prompts, directory scans for image filenames in references/concatenation.md.
  • Boundary markers: None explicitly implemented to isolate user content from workflow logic.
  • Capability inventory: Shell execution via subprocess, process termination via psutil, and API interactions in references/api-reference.md.
  • Sanitization: No evidence of input validation or sanitization for shell command arguments or prompt interpolation.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 19, 2026, 05:25 AM