image-edit

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the runcomfy CLI tool to execute image processing tasks. These commands follow a structured JSON input format (--input '{...}') and are documented as standard operations for the RunComfy platform. The skill includes explicit security notes stating the CLI does not shell-expand user prompts, which helps prevent command injection.
  • [EXTERNAL_DOWNLOADS]: The skill documentation describes fetching image and mask assets from external HTTPS URLs. These are processed by the remote Model API and downloaded by the local CLI. The skill implements a 2 GiB download cap as a safety measure against disk-fill attacks.
  • [SAFE]: The skill references established services (RunComfy, Google, OpenAI, Black Forest Labs) and provides clear instructions for handling API tokens securely via environment variables or local configuration files with restricted permissions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 04:10 AM
Security Audit — agent-trust-hub — image-edit