The Agent Skills Directory

[SAFE]: The skill provides a robust set of tools for generating images and video via ComfyUI. No malicious patterns were detected.- [EXTERNAL_DOWNLOADS]: The scripts/comfyui_setup.sh script installs the official comfy-cli tool using standard package managers like pipx or uv. It also downloads ComfyUI from official sources. These operations are essential for the skill's primary setup function.- [COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/hardware_check.py to discover GPU capabilities via nvidia-smi, rocm-smi, and system tools like powershell and sysctl. These are standard discovery patterns for hardware-dependent software.- [REMOTE_CODE_EXECUTION]: The automated scan flagged patterns like curl ... | python3. Review of scripts/comfyui_setup.sh and SKILL.md shows these are used to pipe local server JSON output to the built-in json.tool module for pretty-printing. This is a benign formatting practice and does not involve executing arbitrary remote code.- [DATA_EXFILTRATION]: scripts/_common.py includes a custom HTTP session handler that automatically strips sensitive headers such as X-API-Key, Authorization, and Cookie when a request is redirected to a different host. This prevents authentication tokens from being leaked to external storage backends (like S3/GCS) when downloading generated content.- [INDIRECT_PROMPT_INJECTION]: The skill processes workflow JSON files and prompt strings. It implements safe_path_join in scripts/_common.py to prevent path-traversal attacks when saving files to disk. While diffusion prompts are processed by the underlying engine, the skill includes tools like scripts/extract_schema.py to allow inspection of workflow structures.- [CREDENTIALS_UNSAFE]: No hardcoded secrets were found. The skill correctly uses environment variables (e.g., COMFY_CLOUD_API_KEY) for authentication.

comfyui