Skip to content
skillsafebeta
← Report library
Purpose / Other

Flux Kontext Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installation fetches and executes unpinned third-party npm software

Source references: 3
What we found

The documentation requires a global npm CLI installation and provides an npx command to install the Skill; neither command pins a specific version or verifies its contents. The code obtained therefore depends on the package or repository state at execution time.

Why this matters

If a package, publisher account, dependency chain, or repository is compromised, installation could execute malicious code with the current user’s privileges. The global installation also leaves a persistent CLI in the user environment.

The documentation provides an `npx` Skill installation command with no pinned version or commit and requires a global npm installation of an unversioned RunComfy CLI. Running these commands downloads and executes whatever third-party content is current at that time, while the global install modifies the user’s software environment. Users can require pinned package versions, commit hashes, and integrity checks, and inspect dependencies in isolation first.

SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill flux-kontext -g```
Show 2 other places
SKILL.md:45In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
SKILL.md:43In the instructionsOpen original file
## Prerequisites1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Source images and edit prompts are disclosed to a third-party model service

Source references: 3
What we found

The CLI sends RunComfy a JSON request containing the prompt and image URL. The image must also be available through a publicly fetchable HTTPS URL, potentially exposing it to the URL host and anyone who obtains that URL.

Why this matters

Portraits, brand assets, unreleased product images, or confidential prompt details may leave the user’s device and become subject to RunComfy’s and the image host’s retention, access, and processing policies.

The workflow requires an edit prompt and a publicly fetchable HTTPS image URL. The documentation also says the CLI sends the JSON request to RunComfy’s Model API and the model server fetches the URL. Sensitive images or prompts would therefore be disclosed to RunComfy and potentially the image host. Users can limit use to non-sensitive material, use short-lived restricted links, and ask about retention and training policies.

SKILL.md:55In the instructionsOpen original file
|---|---|---|---|---|| `prompt` | string | yes | — | Single declarative edit instruction. || `image` | string | yes | — | Single source image URL (publicly fetchable HTTPS). || `aspect_ratio` | enum | no | (input) | Pick from supported W:H options on the model page. |
Show 2 other places
SKILL.md:159In the instructionsOpen original file
The skill invokes `runcomfy run blackforestlabs/flux-1-kontext/pro/edit` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/blackforestlabs/flux-1-kontext/pro/edit`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:165In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The command installs the Skill directly from a GitHub repository without pinning a commit, tag, or version. If that repository changes, the same command may install content different from the text audited here. Users can ask for a pinned commit and checksum, or inspect the resolved version before installation.

SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill flux-kontext -g```
Show 1 other places
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill flux-kontext -g```
Low risk

Interactive login persistently stores a usable API token in the user’s home directory

Source references: 3
What we found

The documentation says login writes an API token to `~/.config/runcomfy/token.json`. Mode 0600 prevents direct reads by other local accounts, but the token remains a persistent credential on disk.

Why this matters

Malware or a compromised process operating as the same OS account could read the token and invoke RunComfy as the user.

Interactive login is a prerequisite, and the security section explicitly says it writes the API token under the user’s home directory. Mode 0600 blocks other local accounts but not programs running as that user, a compromised account, or exposed backups. Users can ask about token lifetime and revocation, or use a short-lived, narrowly scoped environment-variable token in an isolated environment.

SKILL.md:46In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
Show 2 other places
SKILL.md:163In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.
SKILL.md:45In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill uses the local RunComfy CLI to submit an edit prompt and one source image to RunComfy’s hosted model API, poll for completion, and download generated files to a chosen directory.

View source
SKILL.md:159In the instructionsOpen original file
The skill invokes `runcomfy run blackforestlabs/flux-1-kontext/pro/edit` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/blackforestlabs/flux-1-kontext/pro/edit`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.

Use requires globally installing the RunComfy CLI and authenticating with RunComfy; CI or containers may instead provide a token through an environment variable.

View source
SKILL.md:45In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.

The interface requires the source image to be an HTTPS URL publicly fetchable by RunComfy’s server, rather than a file kept only on the local machine.

View source
SKILL.md:55In the instructionsOpen original file
|---|---|---|---|---|| `prompt` | string | yes | — | Single declarative edit instruction. || `image` | string | yes | — | Single source image URL (publicly fetchable HTTPS). || `aspect_ratio` | enum | no | (input) | Pick from supported W:H options on the model page. |
Start here · InstructionsSKILL.md
flux-kontext
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:17In the instructionsOpen original file
  edit with this model.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:23In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=flux-kontext) · [Model page](https://www.runcomfy.com/models/blackforestlabs/flux-1-kontext-pro/image-to-image?utm_source=skills.sh&utm_medium=skill&utm_campaign=flux-kontext) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/flux-kontext)
SKILL.md:70In the instructionsOpen original file
    "prompt": "Keep the person'\''s face, pose, and clothing unchanged. Add an orange umbrella in her left hand and a slight smile.",    "image": "https://.../portrait.jpg"  }' \
Run commands
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill flux-kontext -g
SKILL.md:66In the instructionsOpen original file
```bashruncomfy run blackforestlabs/flux-1-kontext/pro/edit \
SKILL.md:77In the instructionsOpen original file
```bashruncomfy run blackforestlabs/flux-1-kontext/pro/edit \
Install extra software packages
SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill flux-kontext -g```
Lines read
168
File checksum (to compare versions)
666a3eb6bd1a7a411f4bbfe6acc50c9c107f68eed60baceba4a22523cbe15a39