Skip to content
skillsafebeta
← Report library
Purpose / Other

Flux 2 Klein Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installs and runs third-party npm software globally

Source references: 3
What we found

The prerequisite uses a global npm installation, whose package and installation scripts run with the current user's permissions. The supplied material does not include the CLI implementation, so its claimed network restrictions, token handling, and download behavior cannot be verified from these lines.

Why this matters

If the published package, a dependency, or a later version is compromised, it could read files or credentials available to the user and modify the user environment.

The prerequisites globally install a third-party npm CLI and then expose an account token through login or an environment variable. The CLI implementation is absent, so its install scripts, token handling, and claimed network boundaries cannot be verified from this source. Users can request a pinned auditable release, install it in isolation, and use a narrowly scoped token.

SKILL.md:47In the instructionsOpen original file
## Prerequisites1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
Show 2 other places
SKILL.md:206In the instructionsOpen original file
1. The skill invokes `runcomfy run blackforestlabs/flux-2-klein/<variant>/text-to-image` with a JSON body matching the schema.2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/blackforestlabs/flux-2-klein/<variant>/text-to-image` with the user's bearer token.3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 seconds.4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose host ends with `.runcomfy.net` or `.runcomfy.com` into `--output-dir`. Other URLs are listed but not fetched.5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you stopped.
SKILL.md:219In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Prompts and reference assets are disclosed to a third-party service

Source references: 3
What we found

The CLI sends the JSON request to RunComfy, and reference-image URLs are fetched by RunComfy's server. Prompts may contain unreleased designs, customer information, or personal data; private URLs may also carry access tokens or signature parameters.

Why this matters

RunComfy can receive the submitted content and any credentials embedded in URLs. The material does not state retention periods, training use, human-access rules, or deletion procedures.

The skill sends prompts with the user's bearer token to RunComfy, while its model server fetches supplied reference-image URLs. Prompt and image contents—and any signed query parameters embedded in a URL—therefore leave the local machine. Sensitivity depends on the user's inputs. Users can exclude confidential data and long-lived private URLs and ask about retention, training use, and deletion policies.

SKILL.md:74In the instructionsOpen original file
### Reference images (both variants)Up to **4 simultaneous reference images** are supported on the same endpoint for style transfer / guided composition. The exact field name in the JSON body is documented on the [model's API tab](https://www.runcomfy.com/models/blackforestlabs/flux-2-klein/9b/text-to-image?utm_source=skills.sh&utm_medium=skill&utm_campaign=flux-2-klein) — pass it through the CLI verbatim. Reference-image use enables editing-style workflows without a separate `/edit` endpoint.
Show 2 other places
SKILL.md:206In the instructionsOpen original file
1. The skill invokes `runcomfy run blackforestlabs/flux-2-klein/<variant>/text-to-image` with a JSON body matching the schema.2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/blackforestlabs/flux-2-klein/<variant>/text-to-image` with the user's bearer token.3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 seconds.4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose host ends with `.runcomfy.net` or `.runcomfy.com` into `--output-dir`. Other URLs are listed but not fetched.5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you stopped.
SKILL.md:221In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Low risk

Remote results are automatically written to a local directory

Source references: 3
What we found

The CLI downloads every result URL on approved domains. Although it claims a 2 GiB per-file cap, the material does not describe a per-job total-size limit, file-count limit, free-space check, or filename-conflict behavior.

Why this matters

Numerous or near-limit outputs could consume substantial disk space and leave generated content in a sensitive directory. Whether same-named files are overwritten cannot be determined from the supplied material.

In wait mode, the CLI automatically downloads result URLs from allowed domains into a user-selected directory. Only a 2 GiB per-file abort is stated; no task-wide byte/count limit, collision policy, or free-space check is shown. Numerous or colliding outputs could therefore consume space or affect existing files, depending on the absent CLI implementation. Users can use an empty isolated directory, apply a disk quota, and ask for aggregate limits and overwrite rules.

SKILL.md:109In the instructionsOpen original file
The CLI submits, polls every 2s until terminal, then downloads any `*.runcomfy.net` / `*.runcomfy.com` URL from the result into `--output-dir`. Stdout is the result JSON. Stderr is progress.
Show 2 other places
SKILL.md:223In the instructionsOpen original file
- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.
SKILL.md:209In the instructionsOpen original file
3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 seconds.4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose host ends with `.runcomfy.net` or `.runcomfy.com` into `--output-dir`. Other URLs are listed but not fetched.5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you stopped.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The install example fetches the named skill from a repository without pinning a release, tag, or commit. The same global-install command could therefore retrieve changed content later. A user can ask for an audited version or commit hash and inspect the resolved package before installation.

SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill flux-2-klein -g```
Show 1 other places
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill flux-2-klein -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Remote GPU jobs may incur account charges

Source references: 2
What we found

Each invocation creates a remote model job, and the documentation explicitly says cancellation prevents billing for stopped GPU work. The invocation examples do not provide pricing, a spending cap, or a pre-generation cost confirmation.

Why this matters

Automated retries, repeated iterations, long-running jobs, or jobs that are not successfully cancelled may accumulate unexpected charges.

Each generation creates a remote API job, and the documentation explicitly connects cancellation with avoiding GPU charges, so calls may consume account credit or incur fees. The supplied material shows no pricing, per-job budget cap, or pre-submission confirmation. Users can require clear per-call and concurrency costs and restrict token spend, concurrency, and automatic retries.

SKILL.md:206In the instructionsOpen original file
1. The skill invokes `runcomfy run blackforestlabs/flux-2-klein/<variant>/text-to-image` with a JSON body matching the schema.2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/blackforestlabs/flux-2-klein/<variant>/text-to-image` with the user's bearer token.3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 seconds.4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose host ends with `.runcomfy.net` or `.runcomfy.com` into `--output-dir`. Other URLs are listed but not fetched.5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you stopped.
Show 1 other places
SKILL.md:49In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.

Inside this skill

8 instruction sections

This Skill is not a local image generator. It requires the third-party RunComfy CLI and a RunComfy account or token to call a hosted model.

View source
SKILL.md:47In the instructionsOpen original file
## Prerequisites1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
SKILL.md:213In the instructionsOpen original file
## What this skill is notNot a self-hosted Flux runner. Not a capability grant — depends on a working RunComfy account. Not multi-tenant.

Generation requests, prompts, and user-supplied inputs are sent to RunComfy over HTTPS; the CLI then polls the remote job and downloads its results.

View source
SKILL.md:206In the instructionsOpen original file
1. The skill invokes `runcomfy run blackforestlabs/flux-2-klein/<variant>/text-to-image` with a JSON body matching the schema.2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/blackforestlabs/flux-2-klein/<variant>/text-to-image` with the user's bearer token.3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 seconds.4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose host ends with `.runcomfy.net` or `.runcomfy.com` into `--output-dir`. Other URLs are listed but not fetched.5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you stopped.

The external CLI stores the login token in the user's configuration directory by default; CI can alternatively supply it through an environment variable.

View source
SKILL.md:219In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.
Start here · InstructionsSKILL.md
flux-2-klein
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 4 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:17In the instructionsOpen original file
  generate with this model.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:23In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=flux-2-klein) · [9B model](https://www.runcomfy.com/models/blackforestlabs/flux-2-klein/9b/text-to-image?utm_source=skills.sh&utm_medium=skill&utm_campaign=flux-2-klein) · [4B model](https://www.runcomfy.com/models/blackforestlabs/flux-2-klein/4b/text-to-image?utm_source=skills.sh&utm_medium=skill&utm_campaign=flux-2-klein) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/flux-2-klein)
SKILL.md:76In the instructionsOpen original file
Up to **4 simultaneous reference images** are supported on the same endpoint for style transfer / guided composition. The exact field name in the JSON body is documented on the [model's API tab](https://www.runcomfy.com/models/blackforestlabs/flux-2-klein/9b/text-to-image?utm_source=skills.sh&utm_medium=skill&utm_campaign=flux-2-klein) — pass it through the CLI verbatim. Reference-image use enables editing-style workflows without a separate `/edit` endpoint.
Run commands
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill flux-2-klein -g
SKILL.md:82In the instructionsOpen original file
```bashruncomfy run blackforestlabs/flux-2-klein/4b/text-to-image \
SKILL.md:90In the instructionsOpen original file
```bashruncomfy run blackforestlabs/flux-2-klein/9b/text-to-image \
Install extra software packages
SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill flux-2-klein -g```
Lines read
224
File checksum (to compare versions)
335a8c7d7f5c1f90d58a999923b1b54696e206cf9311dbeacac8c0ad2ba565b4