comfy-model-downloader
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
uv runto interact with thecomfy-modelsCLI tool for downloading and validating model profiles. - [EXTERNAL_DOWNLOADS]: The skill downloads AI model weights and configuration files from external sources including Hugging Face and Civitai. Downloads from Hugging Face target a trusted organization, and Civitai is recognized as a well-known service for AI model hosting.
- [INDIRECT_PROMPT_INJECTION]: The skill maps natural language user requests to specific CLI arguments, which presents a surface for potential injection if not strictly validated.
- Ingestion points: Natural language user requests for image, video, or music generation and model downloads described in
SKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded instructions are present in the skill body.
- Capability inventory: Subprocess execution of the
comfy-modelsCLI tool viauv runas documented inSKILL.md. - Sanitization: The skill provides a detailed 'Capability Mapping' and 'Supported Built-In Profiles' list which serves as a whitelist for the agent to validate user requests against.
Audit Metadata