The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The CustomSaveNode code example takes a user-provided prefix input that is used to construct file paths without sanitization. An attacker or a subverted agent could provide a prefix containing directory traversal characters (e.g., ../../) to write files to arbitrary locations on the filesystem.
Ingestion points: prefix input in the CustomSaveNode class (SKILL.md).
Boundary markers: None present; the prefix is interpolated directly into a filename string.
Capability inventory: File system write access via pil_image.save() (SKILL.md).
Sanitization: Absent; the code directly joins the output directory with the unsanitized prefix-based filename.
[COMMAND_EXECUTION]: The skill documents and provides examples for node execution logic that performs file system operations, including saving images, audio, and 3D models using both built-in helpers and manual os path operations.
Evidence: Use of os.path.join, folder_paths.get_output_directory(), and pil_image.save() in the CustomSaveNode example.
[DATA_EXFILTRATION]: The skill provides examples of embedding workflow metadata (the prompt and extra_pnginfo) directly into saved image files using PIL.PngImagePlugin.PngInfo. While standard for ComfyUI, this facilitates the storage and potential exfiltration of internal agent instructions or configuration within media files.
Evidence: metadata.add_text("prompt", json.dumps(cls.hidden.prompt)) in CustomSaveNode.

comfyui-node-outputs