image-edit
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
runcomfyCLI tool to execute image processing tasks. These commands follow a structured JSON input format (--input '{...}') and are documented as standard operations for the RunComfy platform. The skill includes explicit security notes stating the CLI does not shell-expand user prompts, which helps prevent command injection. - [EXTERNAL_DOWNLOADS]: The skill documentation describes fetching image and mask assets from external HTTPS URLs. These are processed by the remote Model API and downloaded by the local CLI. The skill implements a 2 GiB download cap as a safety measure against disk-fill attacks.
- [SAFE]: The skill references established services (RunComfy, Google, OpenAI, Black Forest Labs) and provides clear instructions for handling API tokens securely via environment variables or local configuration files with restricted permissions.
Audit Metadata