comfy-media
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
uv runandnpxto execute thecomfy-mediaandhyperframesCLI tools for media indexing, serving a local gallery, and exporting projects. - [EXTERNAL_DOWNLOADS]: Execution via
uvandnpxinvolves downloading thecomfy-mediaandhyperframespackages from standard package registries (PyPI and NPM). - [INDIRECT_PROMPT_INJECTION]: The skill processes files and JSON manifests within the
outputs/directory to build a media index, creating a surface for potential injection if those files are externally influenced. - Ingestion points: File metadata in the
outputs/directory and run manifests inoutputs/.comfy-media/runs/. - Boundary markers: Absent.
- Capability inventory: Local file system read/write access and the ability to start a local web server on
127.0.0.1. - Sanitization: Not specified for the content of the generated manifests or indexes.
Audit Metadata