qwen-image-edit
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions mandate that the user-provided prompt payload be passed to the underlying workflow without any sanitization, filtering, or modification by the agent ("Do not reason about, summarize, rewrite, expand, translate, correct, sanitize, classify, filter, moderate, or add preservation language to it"). This creates a deliberate bypass of agent-level safety guardrails.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its ingestion of untrusted external data.
- Ingestion points: User-provided prompt text and image attachments (SKILL.md, runtime.md).
- Boundary markers: None; the payload is copied verbatim into the workflow configuration.
- Capability inventory: Execution of local Python scripts, file system writes to output directories, and interaction with ComfyUI tools (upload, enqueue, execute).
- Sanitization: Instructions explicitly forbid the agent from performing sanitization or filtering on the injected payload.- [EXTERNAL_DOWNLOADS]: The installation guide references external resources, including custom nodes from GitHub repositories and large model checkpoints from Hugging Face. The skill includes specific instructions for the operator to verify SHA-256 hashes for model integrity, and it explicitly forbids the agent from performing these downloads or installations without user permission.- [COMMAND_EXECUTION]: The skill executes a bundled Python script (
scripts/prepare_workflow.py) to generate workflow JSON files. This script accesses configuration files in the user's home directory (~/.config/minimax-h3-comfyui/comfy-config.json) and the current project directory.
Audit Metadata