comfyui-assets
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a bundled script (
scripts/comfyui_control.py) to handle file uploads and downloads. - Evidence: Bundled commands in
SKILL.mdinvoke the Python script to interface with the ComfyUI server. - [INDIRECT_PROMPT_INJECTION]: The skill processes history records and node outputs from a ComfyUI server, which constitutes an ingestion of untrusted data.
- Ingestion points: The skill reads history records and node outputs in
SKILL.md. - Boundary markers: None explicitly defined, but usage is scoped to server-returned metadata.
- Capability inventory: The skill has file-write and network-upload capabilities via the bundled script.
- Sanitization: The instructions explicitly require the agent to sanitize local filenames before saving them to the filesystem.
- [SAFE]: The skill instructions proactively mitigate common security risks such as path traversal and command injection by instructing the agent to use server-assigned references and sanitize user-controlled strings.
Audit Metadata