The Agent Skills Directory

[SAFE]: No malicious patterns or security risks were identified. The skill is a documentation-only design reference that promotes robust security practices.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection via user-supplied workflows and job parameters but provides explicit mitigation strategies.
Ingestion points: Processes workflow templates and job parameters via POST /jobs as described in SKILL.md.
Boundary markers: Recommends validating bounded inputs, preserving numeric types, and rejecting unknown nodes or parameters.
Capability inventory: Describes interactions with external databases (Postgres/SQLite), object storage (S3), and network communication with ComfyUI backends.
Sanitization: Explicitly mandates using JSON encoders instead of shell interpolation and requires HMAC signature verification for all incoming webhooks as shown in references/integration.md.
[DATA_EXPOSURE_&_EXFILTRATION]: The skill actively advises against data exposure by recommending the use of secret stores, loopback listeners for development, and preventing the logging of credentials or JWTs.
[COMMAND_EXECUTION]: A troubleshooting snippet in references/troubleshooting.md uses curl to verify local connectivity to 127.0.0.1:8188. This is a standard diagnostic practice and is scoped to the loopback interface.

comfyui-gateway