relight
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill utilizes the @runcomfy/cli package and runcomfy.com endpoints, which are confirmed vendor resources associated with the skill author prime-skills.
- [PROMPT_INJECTION]: The skill processes external image URLs and text prompts, which constitutes an indirect prompt injection surface.
- Ingestion points: User-provided image URLs and lighting descriptions are ingested as input for the CLI tool (SKILL.md).
- Boundary markers: Input data is encapsulated within a JSON string passed via the --input argument to prevent shell expansion.
- Capability inventory: Command execution is scoped to the runcomfy CLI tool through the Bash interface.
- Sanitization: The documentation explicitly states that the CLI does not shell-expand prompt content, minimizing the risk of command injection.
Audit Metadata