comfyui-prompt-automation-orchestrator
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto perform HTTP POST requests to a remote ComfyUI Direct API endpoint. This is a standard method for interacting with external image generation services and matches the stated purpose of the skill. - [EXTERNAL_DOWNLOADS]: The workflow relies on an external utility script located at
/Users/zgbot/.hermes/scripts/prompt_parser_util.py. The script path aligns with the author's identity and appears to be a local helper tool rather than an untrusted remote download. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external Markdown files which could theoretically contain malicious instructions.
- Ingestion points: Markdown files in the
Food Prep Contentdirectory. - Boundary markers: None specified in the documentation.
- Capability inventory: File system read access, shell command execution via
curl, and execution of a local Python script. - Sanitization: The skill employs a dedicated parser (
prompt_parser_util.py) to extract specific text blocks, which provides a layer of structural validation.
Audit Metadata