comfyui-run
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates ComfyUI tasks by executing a local Python script at 'scripts/comfyui_control.py'. This script handles workflow submission, job polling, and environment management.
- [EXTERNAL_DOWNLOADS]: The skill downloads media files from the ComfyUI server's output endpoint to the local environment upon completion of a workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data which creates a surface for indirect prompt injection.
- Ingestion points: Reads 'WORKFLOW.json' files and ingests history and error details from the ComfyUI server.
- Boundary markers: There are no instructions providing delimiters or ignore-markers for the content within the workflow files or server responses.
- Capability inventory: Includes shell command execution (via Python script), network operations for media downloading, and filesystem writes for run logging.
- Sanitization: The procedure does not specify validation or sanitization of the JSON workflow structure or server output.
Audit Metadata