comfyui-discover
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses established procedures and bundled Python scripts to manage server discovery. It explicitly advises against using potentially dangerous shell commands like
find,ls, orwhich, instead favoring controlled API interactions. - [INDIRECT_PROMPT_INJECTION]: The skill provides an interface for ingesting data from external ComfyUI servers.
- Ingestion points: The skill reads server info, system stats, node schemas, and model inventories (SKILL.md, Procedure steps 1, 5, 8, and 9).
- Boundary markers: Not explicitly defined in the markdown instructions.
- Capability inventory: Command execution is limited to specific bundled scripts (
python scripts/comfyui_control.pyandpython scripts/workflow_catalog.py). - Sanitization: Processing logic is contained within the referenced scripts, minimizing prompt-level injection risks.
Audit Metadata