panel-node-pack-sync
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a robust synchronization workflow for ComfyUI components using authorized platform tools. It incorporates defensive design patterns by explicitly forbidding the override of user-defined version pins without consent and requiring the agent to verify installation success by reading the final state from disk.
- [DATA_EXFILTRATION]: The instructions include checking local configuration paths such as
~/.comfyui-mcp/.envand environment variables to identify version pins. This access is restricted to the application's own configuration context for the purpose of respecting user settings and does not involve unauthorized data collection or external transmission. - [INDIRECT_PROMPT_INJECTION]: The skill processes output from the
install_comfyuitool, including dynamic fields likesync.summaryandpin.reason. It mitigates potential injection risks by providing specific constraints on how the agent should interpret and report this data, ensuring that the agent's behavior remains dictated by the skill's internal logic rather than external tool strings.
Audit Metadata