comfyui-mcp-agent

SUSPICIOUS: the skill’s core capabilities mostly match its stated ComfyUI management purpose, but its footprint is broad. The biggest concerns are mutable install paths, arbitrary GitHub-based custom node installation, remote tunnel exposure, and transitive skill generation from external URLs. No clear credential theft or covert exfiltration is shown, so this is not confirmed malware, but it is a medium-high risk agent skill.