comfy-deploy

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill reads deployment logs via comfy deploy logs, which the skill explicitly identifies as attacker-controlled text written by custom node code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill operates comfy deploy commands that create and scale paid serverless compute deployments (comfy deploy up, start, scale), constituting direct financial operations. Authentication is handled via comfy cloud login or COMFY_CLOUD_API_KEY validated by the service backend, establishing independent access control.