image-inpainting
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the
@runcomfy/clipackage via the npm registry, which is the primary tool for interacting with the RunComfy platform. - [COMMAND_EXECUTION]: The skill invokes the
runcomfyCLI to perform image edits. It mitigates shell injection risks by encapsulating user-provided prompts and URLs into a structured JSON object passed to the CLI. - [SAFE]: Secret management is handled through standard environment variables or a local configuration file with restricted permissions (0600), avoiding the use of hardcoded credentials.
- [PROMPT_INJECTION]: The skill processes untrusted image and mask URLs. The documentation acknowledges the risk of indirect prompt injection from external assets and provides guidance on verifying these inputs.
Audit Metadata