{"id":"cmt9402mw32p8ad09lm1e5q3d","slug":"comfyui","publicId":"7a73b185-5c03-4dbb-af72-02e238f339a3","name":"comfyui","description":"Generate images, video, and audio via diffusion workflows.","version":"5.1.0","author":"[kshitijk4poor, alt-glitch, purzbeats]","license":"MIT","compatibility":"Requires ComfyUI (local, Comfy Desktop, or Comfy Cloud) and comfy-cli (auto-installed via pipx/uvx by the setup script).","status":"completed","overallGrade":"F","scannerVersion":9,"fileCount":33,"hasSkillMd":true,"hasScripts":true,"hasReferences":true,"hasEvals":true,"hasAssets":false,"sourceType":"github","sourceUrl":"https://github.com/NousResearch/hermes-agent/tree/main/skills/creative/comfyui","createdAt":"2026-08-25T20:20:15.319Z","completedAt":"2026-08-25T20:20:15.314Z","visibility":"public","publishedAt":"2026-06-02T04:04:19.749Z","category":"","frameworks":[],"badgeStatus":"flagged","downloadCount":0,"verdictRationale":{"summary":"Skill failed: 1 hard fail in security or structure checks.","verdict":"fail","scanners":[{"source":"vettd","weight":1,"verdict":"fail"},{"source":"cisco","weight":0.8,"verdict":"fail"}],"consensus":"fail","warnTriggers":["Safety bypass flag detected","References external URL — review for indirect prompt injection risk","Description suggests benign skill but code contains malicious security patterns"],"policyVersion":"consensus-v1","hardFailTriggers":["Remote code execution via pipe to shell"]},"verdictPolicyVersion":"consensus-v1","skillId":"cmpw45guw00rqad077f71irnl","findings":[{"id":"cmt9402my32qgad097vrd57e7","source":"cisco","category":"security","label":"Direct socket connection to external server","detail":"scripts/run_workflow.py:274 — Pattern detected: socket.create_connection","severity":"critical","ruleId":"DATA_EXFIL_SOCKET_CONNECT","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"8a9ee1bf528b7d522af92b991af47bb2","filepath":"scripts/run_workflow.py"},{"id":"cmt9402my32qhad092gvpgogz","source":"cisco","category":"security","label":"Direct socket connection to external server","detail":"scripts/ws_monitor.py:158 — Pattern detected: socket.create_connection","severity":"critical","ruleId":"DATA_EXFIL_SOCKET_CONNECT","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"1e156441f45b90a1232cdf8d88cd0fc8","filepath":"scripts/ws_monitor.py"},{"id":"cmt9402my32q6ad094irfaq4j","source":"vettd","category":"security","label":"Remote code execution via pipe to shell","detail":"Detected in scripts/comfyui_setup.sh:238 — `curl -fsS \"http://127.0.0.1:$PORT/system_stats\" | python3 -m json.tool 2>/dev/null || true`","severity":"critical","ruleId":"VTD-0020","owaspLlmCategory":null,"intent":"malicious","chainId":null,"fingerprint":"86f9130a0a1e36c4a156c8d49c8198fc","filepath":"scripts/comfyui_setup.sh"},{"id":"cmt9402my32qiad096wm9y2f2","source":"cisco","category":"security","label":"Infinite loop without clear exit condition","detail":"scripts/ws_monitor.py:163 — Pattern detected: while True:","severity":"high","ruleId":"RESOURCE_ABUSE_INFINITE_LOOP","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"40f1feb445aff5d5dd73a32d27d3638d","filepath":"scripts/ws_monitor.py"},{"id":"cmt9402mx32poad09jgrb40ds","source":"vettd","category":"scripts","label":"Interactive prompts detected","detail":"scripts/_common.py: Agents run in non-interactive shells — replace prompts with CLI flags or stdin","severity":"high","ruleId":"VTD-0115","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"732df98b072b433f23692d2903c813dc","filepath":"scripts/_common.py"},{"id":"cmt9402my32q2ad092zucjgwd","source":"vettd","category":"scripts","label":"Interactive prompts detected","detail":"scripts/run_workflow.py: Agents run in non-interactive shells — replace prompts with CLI flags or stdin","severity":"high","ruleId":"VTD-0115","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"af48b1d4de85eda884f5bb0475240504","filepath":"scripts/run_workflow.py"},{"id":"cmt9402my32qbad098qq63fi5","source":"vettd","category":"security","label":"Description suggests benign skill but code contains malicious security patterns","detail":"Description uses benign-sounding terms (diff, generate) but the package contains malicious security findings. Review carefully.","severity":"medium","ruleId":"VTD-0087","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"96d138ff478e5ab4c2c04c774f69e5c8","filepath":""},{"id":"cmt9402my32qead09zr70l5h9","source":"cisco","category":"security","label":"Outbound network request primitives that can transmit data externally","detail":"scripts/_common.py:577 — Pattern detected: urllib.request.Request(","severity":"medium","ruleId":"DATA_EXFIL_NETWORK_REQUESTS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2478b74cea0c45461e157a53a4726e42","filepath":"scripts/_common.py"},{"id":"cmt9402my32qfad09x6wzl50m","source":"cisco","category":"security","label":"Outbound network request primitives that can transmit data externally","detail":"scripts/_common.py:597 — Pattern detected: urllib.request.Request(","severity":"medium","ruleId":"DATA_EXFIL_NETWORK_REQUESTS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2478b74cea0c45461e157a53a4726e42","filepath":"scripts/_common.py"},{"id":"cmt9402my32q9ad09k7d66g5x","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42638a8b7e9fc5df27449992eaebc724","filepath":"SKILL.md"},{"id":"cmt9402my32qcad09ss5x4dys","source":"cisco","category":"security","label":"Undeclared network usage","detail":"/tmp/cisco-shim-7agwuebv/SKILL.md — Skill code uses network libraries but doesn't declare network requirement","severity":"medium","ruleId":"TOOL_ABUSE_UNDECLARED_NETWORK","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"27070541d97e3748cc0ceb6394ea8d48","filepath":"/tmp/cisco-shim-7agwuebv/SKILL.md"},{"id":"cmt9402my32qdad092hbyi1n8","source":"cisco","category":"security","label":"Dangerous data flow in command pipeline","detail":"references/rest-api.md:3 — Pipeline downloads data from the network and executes it: `curl -s \"http://127.0.0.1:8188/object_info\" | python3 -m json.tool`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)","severity":"low","ruleId":"PIPELINE_TAINT_FLOW","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42d2f4c5f71570a4f0c4aca6e3a31381","filepath":"references/rest-api.md"},{"id":"cmt9402my32q7ad09v9jnwsnp","source":"vettd","category":"security","label":"Safety bypass flag detected","detail":"Detected in scripts/comfyui_setup.sh:26 — `#   --force-cloud-override                    Install locally even if hw says cloud`","severity":"low","ruleId":"VTD-0028","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"75656388eeca2ce5bc5c4fc2c4ff8d0f","filepath":"scripts/comfyui_setup.sh"},{"id":"cmt9402my32q8ad09fp3yrf44","source":"vettd","category":"security","label":"No prompt injection or jailbreak signals detected","detail":"Scanned text content for instruction override, jailbreak framing, credential solicitation, and embedded injection markers","severity":"info","ruleId":"VTD-0092","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"ee5675c6452295fc92108d4c30cfebf6","filepath":""},{"id":"cmt9402mx32pead09w333ck5i","source":"vettd","category":"security","label":"No repository link","detail":"No repository field found in SKILL.md frontmatter. Skills without a verifiable source repository cannot be externally audited.","severity":"info","ruleId":"VTD-0083","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"e09767e7943872a2754f559ba01ef7db","filepath":""},{"id":"cmt9402mx32pbad09dqxuyyyf","source":"vettd","category":"structure","label":"references/ directory present","detail":"Additional documentation files available for progressive disclosure","severity":"info","ruleId":"VTD-0097","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"a5f22b7185c58877c3d5a94338930d62","filepath":""},{"id":"cmt9402mx32paad0914q6gs6o","source":"vettd","category":"structure","label":"scripts/ directory present","detail":"Bundled executable scripts found","severity":"info","ruleId":"VTD-0096","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"21a167b473d29b0a653734953d43b2fc","filepath":""},{"id":"cmt9402mx32p9ad09aj5y45ka","source":"vettd","category":"structure","label":"SKILL.md present","detail":"Required skill definition file found","severity":"info","ruleId":"VTD-0095","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c4ab14319b89c3d0802fadf0dd105bac","filepath":""},{"id":"cmt9402mx32pdad09p4w5oc00","source":"vettd","category":"structure","label":"Valid name field","detail":"Name \"comfyui\" follows spec (lowercase, hyphens, ≤64 chars)","severity":"info","ruleId":"VTD-0099","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"5ba54eca0b3e299a99112de98cbcd97f","filepath":""},{"id":"cmt9402mx32pgad09bdeq4p2o","source":"vettd","category":"description","label":"Description lacks usage context","detail":"Add context like \"Use this skill when...\" to help agents know when to activate it","severity":"info","ruleId":"VTD-0111","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e325ab773f2c18f6f9d864add6464110","filepath":""},{"id":"cmt9402mx32pfad09c53jzibb","source":"vettd","category":"description","label":"Description within character limit","detail":"58/1024 characters used","severity":"info","ruleId":"VTD-0110","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"66553d595a652c45a6f0d4353184b37e","filepath":""},{"id":"cmt9402mx32pjad09v4sej6e2","source":"vettd","category":"best-practices","label":"Checklist pattern found","detail":"Explicit checklists help agents track progress in multi-step workflows","severity":"info","ruleId":"VTD-0104","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"1aee5afe2aa05694677d8ef2d8066900","filepath":""},{"id":"cmt9402mx32piad09q8qjh4ej","source":"vettd","category":"best-practices","label":"Examples included","detail":"Found code blocks, input/output samples, or an examples section — concrete samples help agents pattern-match effectively","severity":"info","ruleId":"VTD-0103","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c2ceb48c4af3c87dafa32ec2596251b8","filepath":""},{"id":"cmt9402mx32pmad095nytvs94","source":"vettd","category":"best-practices","label":"Progressive disclosure used","detail":"SKILL.md body references files in references/, scripts/, or assets/ — agents can load additional context on demand instead of consuming everything upfront","severity":"info","ruleId":"VTD-0107","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"6fd5870d64ef20cb2bbaf421f8655a32","filepath":""},{"id":"cmt9402mx32phad0927h0vzjc","source":"vettd","category":"best-practices","label":"SKILL.md exceeds 500 lines","detail":"584 lines — consider moving detailed reference material to references/","severity":"info","ruleId":"VTD-0101","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42debaa072535bf5650f90d3168f0b93","filepath":""},{"id":"cmt9402mx32pkad09iqdrpgo5","source":"vettd","category":"best-practices","label":"Step-by-step workflow found","detail":"Structured procedures improve reliability for complex tasks","severity":"info","ruleId":"VTD-0106","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2368c9a31ac52269c854f105795cf28c","filepath":""},{"id":"cmt9402mx32plad09852lz3dm","source":"vettd","category":"best-practices","label":"Validation loop referenced","detail":"Instructions for the agent to validate its own work before proceeding","severity":"info","ruleId":"VTD-0105","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e5a31b775d1df438cbeb1e3fcb2ff503","filepath":""},{"id":"cmt9402mx32pqad09fhstq3xl","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/auto_fix_deps.py: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"567100f3420676822b8b6f074954aa27","filepath":"scripts/auto_fix_deps.py"},{"id":"cmt9402mx32prad09kgj5iokk","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/check_deps.py: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"ddc24feb78bcad6a0b5ca978806a37a4","filepath":"scripts/check_deps.py"},{"id":"cmt9402mx32psad09oj45d8wp","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/comfyui_setup.sh: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"1390efc6ca2425c945c877f0ffba9d21","filepath":"scripts/comfyui_setup.sh"},{"id":"cmt9402mx32ptad096q0hy7zz","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/extract_schema.py: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"d1cf75ef2175935cd41a114d3e7e4aa0","filepath":"scripts/extract_schema.py"},{"id":"cmt9402mx32pvad09xzo02gxa","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/fetch_logs.py: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e7d02f1fd222fd77a42cb7dbdaf7762c","filepath":"scripts/fetch_logs.py"},{"id":"cmt9402mx32pwad095hxu5d0l","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/hardware_check.py: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2a2d5c3fcdac6d343c8f0c97afc3f140","filepath":"scripts/hardware_check.py"},{"id":"cmt9402mx32pyad09gtgnkzzt","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/health_check.py: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"8ac0d3ec93603bf1432da8133e02e171","filepath":"scripts/health_check.py"},{"id":"cmt9402mx32q0ad09vlyow75a","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/run_batch.py: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"008882f87509df36576ce4bb0012a4da","filepath":"scripts/run_batch.py"},{"id":"cmt9402my32q1ad09fr7p1aka","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/run_workflow.py: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"1666dfc6e665ffdcb4dbb5610fd08e6c","filepath":"scripts/run_workflow.py"},{"id":"cmt9402my32q4ad093i7qbxee","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/ws_monitor.py: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"0dac628fd786fbf4a819db1f50d1bf75","filepath":"scripts/ws_monitor.py"},{"id":"cmt9402mx32pnad09aij78ohf","source":"vettd","category":"scripts","label":"No --help support","detail":"scripts/_common.py: Add argument parsing with --help output so agents know the script's interface","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2edc3580cb9165c14daa9d439d2f86ff","filepath":"scripts/_common.py"},{"id":"cmt9402mx32ppad0998t7nnwm","source":"vettd","category":"scripts","label":"Structured output format","detail":"scripts/_common.py: Uses JSON/CSV output which is easily parseable by agents","severity":"info","ruleId":"VTD-0116","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"7cb2d09af4840de2907054acadbd5e45","filepath":"scripts/_common.py"},{"id":"cmt9402mx32puad090too4g5r","source":"vettd","category":"scripts","label":"Structured output format","detail":"scripts/extract_schema.py: Uses JSON/CSV output which is easily parseable by agents","severity":"info","ruleId":"VTD-0116","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"447ca30656d7f85b3212d281fb35960b","filepath":"scripts/extract_schema.py"},{"id":"cmt9402mx32pxad09uwfq1wbx","source":"vettd","category":"scripts","label":"Structured output format","detail":"scripts/hardware_check.py: Uses JSON/CSV output which is easily parseable by agents","severity":"info","ruleId":"VTD-0116","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"92addab572265c5f331630b67bb58a74","filepath":"scripts/hardware_check.py"},{"id":"cmt9402mx32pzad090mywyjj3","source":"vettd","category":"scripts","label":"Structured output format","detail":"scripts/health_check.py: Uses JSON/CSV output which is easily parseable by agents","severity":"info","ruleId":"VTD-0116","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"16737dc2b633a9c1162cac920b34ba40","filepath":"scripts/health_check.py"},{"id":"cmt9402my32q3ad090fxtistj","source":"vettd","category":"scripts","label":"Structured output format","detail":"scripts/run_workflow.py: Uses JSON/CSV output which is easily parseable by agents","severity":"info","ruleId":"VTD-0116","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"405c69d867a0fcbfc2192d6a4c742576","filepath":"scripts/run_workflow.py"},{"id":"cmt9402my32q5ad093j05ma7n","source":"vettd","category":"scripts","label":"Structured output format","detail":"scripts/ws_monitor.py: Uses JSON/CSV output which is easily parseable by agents","severity":"info","ruleId":"VTD-0116","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"b47d147bca84266c333d127535c29c61","filepath":"scripts/ws_monitor.py"},{"id":"cmt9402my32qaad09d2a0p8di","source":"vettd","category":"evals","label":"Eval files found","detail":"1 evaluation file(s) detected in non-JSON format (markdown, YAML, JSONL, etc.)","severity":"info","ruleId":"VTD-0123","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"051f0233de45de009f4c8bb9864ec726","filepath":""},{"id":"cmt9402mx32pcad09u4u2ny6d","source":"vettd","category":"evals","label":"Evaluation test cases found","detail":"evals/ directory or evals.json present for testing skill quality","severity":"info","ruleId":"VTD-0118","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"41d019e0494a4a9763fc23c948d14e09","filepath":""}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"F","findingCount":7,"criticalCount":2,"highCount":3},{"source":"vettd","status":"success","verdict":null,"grade":"F","findingCount":39,"criticalCount":1,"highCount":3}],"user":{"name":"Justin Pacella","image":"https://avatars.githubusercontent.com/u/97124458?v=4"},"repository":{"owner":"NousResearch","name":"hermes-agent"},"freshness":{"status":"unreachable","reason":"ref_not_found","retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T11:30:39.342Z","lastVerifiedAt":"2026-08-29T21:43:14.783Z","lastChangeDetectedAt":"2026-08-12T12:33:46.817Z","scannedHash":"dc7c409ced2d1dd918795de306115ca51d553ab1","latestUpstreamHash":"dc7c409ced2d1dd918795de306115ca51d553ab1","nextCheckDueAt":"2026-10-28T11:30:39.342Z"},"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":null,"rows":[]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":null,"rows":[]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":52,"publisherSupplied":["name","description","author","version","license"]}