comfyui-core
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a background Bash task to run a local Node.js monitoring script (
monitor-progress.mjs) to track the status of ComfyUI generation jobs without polling the main API. This is a standard operational pattern for the Model Context Protocol (MCP) and is used for job lifecycle management. - [EXTERNAL_DOWNLOADS]: The instructions direct the agent to proactively download missing AI models from well-known services, specifically HuggingFace and CivitAI. This behavior is consistent with the skill's primary purpose of managing image generation pipelines.
- [EXTERNAL_DOWNLOADS]: The skill documents the use of the CivitAI REST API for model discovery and authenticated downloads. It utilizes an environment variable (
CIVITAI_API_TOKEN) for authentication, following standard security practices for secret management instead of hardcoding credentials.
Audit Metadata