skills/yaofeng/my-skills/comfyui/Gen Agent Trust Hub

comfyui

Pass

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using curl and base64 to interact with the ComfyUI API and process image files for transmission.
  • [EXTERNAL_DOWNLOADS]: The skill performs network requests to download generated image files from the user-configured COMFYUI_API_SERVER to the local filesystem.
  • [DATA_EXFILTRATION]: The skill transmits data externally, including authentication tokens and Base64-encoded image content. While this is the intended functional behavior, it establishes a network communication surface for data transfer.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it interpolates untrusted user-provided descriptions into API request bodies and image generation prompts.
  • Ingestion points: User-provided image descriptions in SKILL.md and associated references.
  • Boundary markers: None identified; user input is processed without delimiters.
  • Capability inventory: Network access and file write capabilities via curl, and file read capability via base64.
  • Sanitization: No validation or escaping of external content is specified before interpolation into prompts.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 12, 2026, 02:11 AM