comfyui-node-update

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute local shell scripts (scripts/extract-comfyui-nodes.sh and scripts/import-new-nodes.sh) and standard CLI tools such as find, rg (ripgrep), and pnpm to manage node data and progress tracking.
  • [DYNAMIC_EXECUTION]: The skill utilizes python3 -c to run inline Python scripts for quality control. These scripts traverse the local filesystem (os.walk) and parse JSON files to identify incomplete or incorrectly formatted documentation.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads and processes external documentation and export files, which could potentially contain malicious instructions intended to influence the agent's output or actions.
  • Ingestion points: Data is read from files in embedded-docs/comfyui_embedded_docs/docs/ and exports/comfyui_nodes_*.json.
  • Boundary markers: None explicitly defined to separate external data from agent instructions during the reading phase.
  • Capability inventory: The agent has the capability to execute shell commands, run dynamic Python code, and write to the local filesystem.
  • Sanitization: The skill includes instructions to "rewrite content" and "never copy-paste," which serves as a manual process to mitigate the risk of directly adopting malicious content from the source files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 11:40 AM