flux-kontext
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
runcomfyCLI tool to perform image edits. This involves running commands likeruncomfy run blackforestlabs/flux-1-kontext/pro/editwith JSON-formatted input. - [EXTERNAL_DOWNLOADS]: The skill references the installation of
@runcomfy/clifrom the npm registry, which is a well-known service for Node.js packages. - [DATA_EXPOSURE]: The skill documents the use of
RUNCOMFY_TOKENfor authentication and notes that the CLI stores tokens in~/.config/runcomfy/token.jsonwith restricted permissions (0600), which is a standard and safe credential management practice. - [SAFE]: The security section of the skill explicitly addresses input boundaries, third-party content risks (image-based prompt injection), and outbound endpoint whitelisting, demonstrating good security documentation practices.
Audit Metadata