comfy-model-downloader

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using uv run to interact with the comfy-models CLI tool for downloading and validating model profiles.
  • [EXTERNAL_DOWNLOADS]: The skill downloads AI model weights and configuration files from external sources including Hugging Face and Civitai. Downloads from Hugging Face target a trusted organization, and Civitai is recognized as a well-known service for AI model hosting.
  • [INDIRECT_PROMPT_INJECTION]: The skill maps natural language user requests to specific CLI arguments, which presents a surface for potential injection if not strictly validated.
  • Ingestion points: Natural language user requests for image, video, or music generation and model downloads described in SKILL.md.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded instructions are present in the skill body.
  • Capability inventory: Subprocess execution of the comfy-models CLI tool via uv run as documented in SKILL.md.
  • Sanitization: The skill provides a detailed 'Capability Mapping' and 'Supported Built-In Profiles' list which serves as a whitelist for the agent to validate user requests against.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 01:36 PM