comfyui-video-production
Warn
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python's
subprocessmodule and PowerShell/Bash scripts to execute various system commands, includingffmpeg,ffprobe,nvidia-smi, andpython main.py. These operations are used for video concatenation, metadata extraction, and starting ComfyUI instances. - [COMMAND_EXECUTION]: The instance management module uses the
psutillibrary to identify and terminate processes listening on specific ports. This allows the skill to restart ComfyUI instances but involves process-level manipulation. - [REMOTE_CODE_EXECUTION]: The evaluation script
eval/run-eval.shexecutes theclaudeCLI tool with dynamically generated prompts. This constitutes execution of an external tool with content derived from test cases. - [PROMPT_INJECTION]: The skill interpolates user-provided prompts into video generation workflows. This creates an indirect prompt injection surface where malicious instructions embedded in data could influence the agent's actions or the behavior of the integrated tools.
- Ingestion points: User prompts, directory scans for image filenames in
references/concatenation.md. - Boundary markers: None explicitly implemented to isolate user content from workflow logic.
- Capability inventory: Shell execution via
subprocess, process termination viapsutil, and API interactions inreferences/api-reference.md. - Sanitization: No evidence of input validation or sanitization for shell command arguments or prompt interpolation.
Audit Metadata