workflow-reader
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes ComfyUI workflow files, which are external, untrusted data sources. A maliciously crafted workflow JSON could embed instructions within node parameters, subgraph names, or model metadata designed to influence the behavior of an AI agent that consumes the analysis output.
- Ingestion points: The
workflow.pyscript reads external JSON files through theload_workflowfunction and parses their content recursively. - Boundary markers: The skill does not implement delimiters or explicit 'ignore embedded instructions' warnings when presenting extracted data to the agent.
- Capability inventory: The tool is limited to file system read access (
pathlib.Path.open) and lacks capabilities for network communication, file writing, or shell execution. - Sanitization: Widget values (
params), node types, and download URLs are extracted and returned as raw strings without validation or sanitization against potential injection patterns.
Audit Metadata