This skill may be intentionally malicious
One or more detected patterns suggest a deliberate attack chain rather than a coding mistake. Review carefully before installing.
comfyui
Generate images, video, and audio with ComfyUI — install, launch, manage nodes/models, run workflows with parameter injection. Uses the official comfy-cli for lifecycle and direct REST/WebSocket API for execution.
This skill includes a SKILL.md descriptor and ships with evals, reference documentation, and scripts. 5 critical and 6 advisory security observations were identified — review the findings below for details.
Vettd Verdict
The overall verdict combines pass, warning, and failure signals across our checks. Click to see how each check is computed.Skill failed: 1 hard fail in security or structure checks.
- · Remote code execution via pipe to shell
- · Safety bypass flag detected
- · References external URL — review for indirect prompt injection risk
- · Description suggests benign skill but code contains malicious security patterns
Link points to the repository’s default branch (current HEAD). Certification reflects the state of the repo on Jun 2, 2026. Scanned at 40ae1706.