viewcomfy-api-rules
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent ingests data from the ViewComfy API, creating an untrusted ingestion point. • Ingestion points: The API response structure, specifically the
outputsarray containing filenames and base64-encoded content as described inSKILL.md. • Boundary markers: No specific delimiters or instructions to ignore potential instructions embedded in the API data are provided. • Capability inventory: The skill requires writing files to the working directory and performing network requests using thehttpxlibrary. • Sanitization: The instructions do not include steps to validate or sanitize filenames or content provided by the API before saving them to the local filesystem. - [DATA_EXFILTRATION]: The skill uses the
httpxlibrary to perform network operations to external endpoints. The integration requires handling and transmitting credentials, such as Client IDs and Client Secrets, to the service provider's infrastructure.
Audit Metadata