comfyui-node-lifecycle
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents an implementation for an output node (SaveMyData) that grants file system write access through external parameters. The provided logic creates a vulnerability surface because it does not demonstrate input validation, potentially allowing path traversal if the code is used to process untrusted data.\n
- Ingestion points: The
filenameanddataparameters in theSaveMyData.executemethod (SKILL.md) ingest external data into the function context.\n - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat these inputs as untrusted or to sanitize them before use.\n
- Capability inventory: The
SaveMyData.executefunction inSKILL.mdcontains a file-write capability using the Pythonopen()function with the'w'(write) flag.\n - Sanitization: Absent; the documentation example does not include path validation or sanitization (such as checking for '..' sequences) to prevent directory traversal attacks.
Audit Metadata