image-inpainting
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents the installation of the
@runcomfy/clipackage via NPM. This is a standard dependency for the skill's stated purpose and originates from the platform's associated service domain. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external image and mask URLs, which constitutes an attack surface for indirect prompt injection where instructions could be embedded in image data or EXIF metadata.
- Ingestion points: External image and mask URLs are passed to the
runcomfy runcommand via the--inputJSON argument. - Boundary markers: The skill includes a 'Security & Privacy' section that explicitly instructs agents to only ingest URLs provided by the user and warns of potential injection from third-party content.
- Capability inventory: The skill uses the
runcomfyCLI tool to interact with remote models. - Sanitization: Content is encapsulated within a JSON string before being passed to the CLI to prevent shell injection, and the skill advises verification of mask provenance.
Audit Metadata