comfy-tools-setup

SUSPICIOUS. The skill’s capabilities match its stated setup purpose and data flows stay local or to official services, but it relies on unpinned GitHub-based tool installation and a transitive skill install. This looks coherent and likely legitimate, yet supply-chain trust is only moderate because mutable upstream code is executed without version pinning or release verification.