relight
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@runcomfy/clipackage from the NPM registry usingnpm i -g @runcomfy/cliornpx. This is the primary tool for interacting with the service.\n- [COMMAND_EXECUTION]: The skill utilizes theBashtool to executeruncomfycommands for authentication and image processing as defined in theallowed-toolsmetadata.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the ingestion of untrusted external content.\n - Ingestion points: The
imageandimage_urlsparameters within the JSON input for theruncomfy runcommand inSKILL.md.\n - Boundary markers: Absent. There are no explicit delimiters or instructions to ignore embedded content within the processed image URLs or prompts.\n
- Capability inventory: The skill has the capability to execute shell commands via
Bash(runcomfy *)across its operational flow.\n - Sanitization: Absent. The skill relies on the CLI tool's handling of input and does not implement independent sanitization or validation of the external assets or prompt strings.
Audit Metadata