controlnet-pose
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official CLI tool from the npm registry, a well-known service.
- [COMMAND_EXECUTION]: Uses the
runcomfycommand for image and video generation. The instructions explicitly use a JSON input pattern to avoid shell injection. - [SAFE]: References the storage of API tokens in a local configuration file (
~/.config/runcomfy/token.json). The skill documentation specifies that the tool sets restrictive file permissions (mode 0600) for this file. - [PROMPT_INJECTION]: Identifies an indirect prompt injection surface involving untrusted third-party URLs for video and image assets. Includes guidance for the agent to treat these inputs as untrusted and provides remediation strategies.
Audit Metadata