comfyui-node-update
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute local shell scripts (
scripts/extract-comfyui-nodes.shandscripts/import-new-nodes.sh) and standard CLI tools such asfind,rg(ripgrep), andpnpmto manage node data and progress tracking. - [DYNAMIC_EXECUTION]: The skill utilizes
python3 -cto run inline Python scripts for quality control. These scripts traverse the local filesystem (os.walk) and parse JSON files to identify incomplete or incorrectly formatted documentation. - [INDIRECT_PROMPT_INJECTION]: The skill reads and processes external documentation and export files, which could potentially contain malicious instructions intended to influence the agent's output or actions.
- Ingestion points: Data is read from files in
embedded-docs/comfyui_embedded_docs/docs/andexports/comfyui_nodes_*.json. - Boundary markers: None explicitly defined to separate external data from agent instructions during the reading phase.
- Capability inventory: The agent has the capability to execute shell commands, run dynamic Python code, and write to the local filesystem.
- Sanitization: The skill includes instructions to "rewrite content" and "never copy-paste," which serves as a manual process to mitigate the risk of directly adopting malicious content from the source files.
Audit Metadata