flux-2-klein
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill requires the global installation of the
@runcomfy/cliNode.js package. While the package version is not specified, it is an official tool from the vendor '@runcomfy' used for Model API interaction. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it processes user-provided text and image URLs.
- Ingestion points: The skill accepts user prompts and reference image URLs as inputs for the image generation process.
- Boundary markers: There are no explicit instructions provided to the agent to treat external data as untrusted instructions.
- Capability inventory: The skill leverages the
@runcomfy/clitool to interact with the RunComfy API and save generated assets to the local disk. - Sanitization: Input is treated as a JSON string to mitigate shell injection risks during CLI execution.
Audit Metadata