viewcomfy-api-rules

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent ingests data from the ViewComfy API, creating an untrusted ingestion point. • Ingestion points: The API response structure, specifically the outputs array containing filenames and base64-encoded content as described in SKILL.md. • Boundary markers: No specific delimiters or instructions to ignore potential instructions embedded in the API data are provided. • Capability inventory: The skill requires writing files to the working directory and performing network requests using the httpx library. • Sanitization: The instructions do not include steps to validate or sanitize filenames or content provided by the API before saving them to the local filesystem.
  • [DATA_EXFILTRATION]: The skill uses the httpx library to perform network operations to external endpoints. The integration requires handling and transmitting credentials, such as Client IDs and Client Secrets, to the service provider's infrastructure.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 08:16 PM