comfy-media

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses uv run and npx to execute the comfy-media and hyperframes CLI tools for media indexing, serving a local gallery, and exporting projects.
  • [EXTERNAL_DOWNLOADS]: Execution via uv and npx involves downloading the comfy-media and hyperframes packages from standard package registries (PyPI and NPM).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes files and JSON manifests within the outputs/ directory to build a media index, creating a surface for potential injection if those files are externally influenced.
  • Ingestion points: File metadata in the outputs/ directory and run manifests in outputs/.comfy-media/runs/.
  • Boundary markers: Absent.
  • Capability inventory: Local file system read/write access and the ability to start a local web server on 127.0.0.1.
  • Sanitization: Not specified for the content of the generated manifests or indexes.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 01:36 PM