Trust Assessment
comfyui-request received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 1 low severity. Key findings include Node lockfile missing, Potential Data Exfiltration via Configurable Network Endpoint.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Data Exfiltration via Configurable Network Endpoint The skill constructs its target URL using `COMFYUI_HOST` and `COMFYUI_PORT` environment variables. It then sends user-provided workflow data and potentially `COMFYUI_USER`/`COMFYUI_PASS` credentials (if configured) to this endpoint. If an attacker can manipulate these environment variables (e.g., through prompt injection into the host LLM), they could redirect sensitive user data and credentials to an arbitrary, potentially malicious, server, leading to data exfiltration. Implement strict validation or whitelisting for `COMFYUI_HOST` and `COMFYUI_PORT` environment variables to ensure they only point to trusted ComfyUI instances. If these variables are user-controlled, ensure they are sanitized and validated to prevent redirection to malicious endpoints (e.g., private IPs, loopback, or known malicious IPs). Additionally, ensure that the environment where the skill runs protects these environment variables from untrusted modification. | LLM | bin/cli.js:89 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/xtopher86/comfyui-request/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/29d5ba0bb0d69c1d)
Powered by SkillShield