comfy-lora-onboarding
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and executes shell commands for file management, such as moving and renaming LoRA files, and invoking AI generation tools like
comfy-imagegenviauv run. These operations are performed within the local/mnt/models/comfyui/lorasdirectory. - [INDIRECT_PROMPT_INJECTION]: The skill's selection logic relies on processing untrusted data from the local filesystem to construct CLI arguments.
- Ingestion points: The agent reads file names and embedded metadata from
.safetensorsfiles within the/mnt/models/comfyui/lorasdirectory. - Boundary markers: None identified; the instructions do not specify delimiters or warnings to ignore potentially malicious content within filenames or metadata.
- Capability inventory: The skill can move files, rename files, and construct command-line arguments for external tools like
comfy-imagegenandcomfy-models. - Sanitization: No explicit instructions are provided to sanitize or escape filenames before they are interpolated into shell commands.
Audit Metadata