image-edit
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
runcomfyCLI tool to perform image edits based on user intent. This requires passing user-defined parameters into shell-executed commands.\n- [EXTERNAL_DOWNLOADS]: The skill requires installation of the@runcomfy/cliNode.js package. This is the official client for the RunComfy service mentioned in the documentation.\n- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted user input that could influence the behavior of backend models.\n - Ingestion points: User-supplied
promptstrings andimage_urls/mask_imageURLs are used as inputs for model execution.\n - Boundary markers: The instructions do not specify any delimiters to isolate user-supplied prompts from internal instructions when building the JSON payload.\n
- Capability inventory: The skill uses the
runcomfyCLI, which has the capability to download files to a local directory and communicate with external APIs.\n - Sanitization: The skill does not describe any methods for validating or sanitizing user-provided text or URLs before processing.
Audit Metadata