Trust Assessment
comfyui-runner received a trust score of 91/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Node lockfile missing, Server-Side Request Forgery (SSRF) via configurable host/port.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Server-Side Request Forgery (SSRF) via configurable host/port The skill constructs a URL using `COMFYUI_HOST` and `COMFYUI_PORT` environment variables, which are explicitly documented as configurable. An attacker able to manipulate these environment variables (e.g., via prompt injection to the host LLM) could direct the skill's `fetch` request to arbitrary internal or external network endpoints. This could lead to internal network scanning, enumeration of services, or triggering actions on vulnerable internal systems. Although the skill explicitly limits its functionality to only perform a `GET` request to the `/health` endpoint, this still poses an information disclosure risk. Implement input validation for `COMFYUI_HOST` and `COMFYUI_PORT` to restrict values to a whitelist of allowed IP addresses or domains, or to prevent private IP ranges and loopback addresses. Consider network egress filtering to prevent connections to unauthorized destinations from the skill's execution environment. | LLM | bin/cli.js:31 | |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. | Dependencies | skills/xtopher86/comfyui-runner/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/5aea6a63db59eeac)
Powered by SkillShield