Skip to content
skillsafebeta
← Report library
Purpose / Other

Gpt Image 2 Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installation runs and globally installs third-party software

Source references: 2
What we found

The instructions require a global npm installation of the RunComfy CLI and provide a Skill installation command executed through npx. These steps run package-ecosystem code, but the supplied source contains no pinned version, integrity hash, or CLI implementation to inspect.

Why this matters

A substituted, compromised, or subsequently changed package could access files and environment variables available to the current user when installation or the CLI runs. Global installation also leaves persistent software on the machine.

The prerequisites globally install the third-party RunComfy CLI through npm, while the npx command installs the skill from a repository/package source. Neither pins a version or commit, and the supplied material does not include the installer or CLI implementation. Running them therefore trusts whatever third-party code resolves at that time. A user can require pinned versions, commits, and integrity checks and restrict global-install privileges.

SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill gpt-image-2 -g```
Show 1 other places
SKILL.md:45In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Prompts and reference images are disclosed to third-party RunComfy processing

Source references: 5
What we found

The CLI sends the JSON request to RunComfy. Editing requires publicly fetchable HTTPS image URLs, which RunComfy's server retrieves. Suggested uses include faces, brand assets, and product material that may be sensitive or unreleased.

Why this matters

Submitted content leaves the local device. Hosting an image at a publicly reachable URL may also expose it to anyone who obtains that URL. The supplied material does not state RunComfy's retention period, training use, deletion process, or processing region.

The live workflow sends prompts in a JSON request to RunComfy. Editing also requires publicly fetchable HTTPS image URLs, which the RunComfy model server retrieves. Prompts, images, and any faces, brand assets, or product information in them therefore leave the device for third-party processing; public URLs may further widen exposure. Users should confirm the material may be disclosed and ask about retention, training, deletion, and access policies.

SKILL.md:65In the instructionsOpen original file
| `prompt` | string | yes | — | Natural-language **edit instruction** || `images` | string[] | yes | — | **Up to 10** reference image URLs (publicly fetchable HTTPS) || `size` | enum | no | `auto` | `auto` (preserve input ratio), or one of the three fixed sizes above |
Show 4 other places
SKILL.md:195In the instructionsOpen original file
1. The skill invokes `runcomfy run openai/gpt-image-2/<endpoint>` with a JSON body matching the schema above.2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/openai/gpt-image-2/<endpoint>` with the user's bearer token.3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 seconds.
SKILL.md:209In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.
SKILL.md:64In the instructionsOpen original file
|---|---|---|---|---|| `prompt` | string | yes | — | Natural-language **edit instruction** || `images` | string[] | yes | — | **Up to 10** reference image URLs (publicly fetchable HTTPS) || `size` | enum | no | `auto` | `auto` (preserve input ratio), or one of the three fixed sizes above |
SKILL.md:129In the instructionsOpen original file
- **State preservation goals.** "**keep** the person's pose and face identity unchanged", "**keep** the brand mark and typography on the package", "**keep** the overall framing". The model needs to know what NOT to change.- **Use directional language for spatial edits.** "Move the headline from top-right to bottom-center", not "reposition the headline".
Medium risk

The RunComfy account token is persisted locally or exposed to the CLI environment

Source references: 4
What we found

Browser login writes the API token into the user's configuration directory, while CI usage places it in RUNCOMFY_TOKEN. The CLI sends it to RunComfy as a bearer token. Mode 0600 limits other local users, but processes running as the same user may still access the file or environment.

Why this matters

If the CLI, a dependency, or another process under the same user account is compromised, the token could be stolen and used to make requests against the RunComfy account, potentially consuming quota or accessing other token-authorized functions.

Login persistently writes the token under the user's configuration directory, while CI places it in an environment variable. The CLI then uses it to authenticate to RunComfy. Mode 0600 blocks direct reads by other local accounts, but software running as the same user may still access the file, and software allowed to inspect the process environment may obtain the variable. Users can restrict same-account processes and use short-lived, revocable, least-privilege tokens.

SKILL.md:47In the instructionsOpen original file
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
Show 3 other places
SKILL.md:195In the instructionsOpen original file
1. The skill invokes `runcomfy run openai/gpt-image-2/<endpoint>` with a JSON body matching the schema above.2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/openai/gpt-image-2/<endpoint>` with the user's bearer token.3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 seconds.
SKILL.md:207In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.
SKILL.md:46In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The install command names a repository and skill but pins no commit, tag, version, or checksum. The same command could therefore resolve to changed upstream content later, so this source alone cannot establish what will actually be installed. A user can ask for a fixed commit and verification method, or inspect the resolved version before installation.

SKILL.md:25In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill gpt-image-2 -g```
Show 1 other places
SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill gpt-image-2 -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Model requests may incur RunComfy GPU charges without a cost-confirmation step

Source references: 4
What we found

The instructions explicitly say cancellation avoids being billed for stopped GPU work, establishing that requests may carry charges. The invocation flow does not require showing the price, available credit, or obtaining confirmation before submission.

Why this matters

If an agent automatically submits requests after a model trigger, RunComfy balance may be consumed without the user seeing per-request cost or a budget ceiling. Repeated editing can increase that exposure.

The source says requests are submitted and polled, and that interruption cancels work so the user is not billed for stopped GPU usage. This supports a plausible charge from invocation. The examples and workflow do not require displaying price, checking a budget, or reconfirming before submission. This does not prove any charge occurred, but automated use could cause unexpected spending. Users can request pricing details, impose account limits, or require confirmation before each paid submission.

SKILL.md:41In the instructionsOpen original file
If the user explicitly asked for GPT Image 2 / ChatGPT Image 2 / Image 2, route here regardless — don't second-guess the model choice.
Show 3 other places
SKILL.md:194In the instructionsOpen original file
1. The skill invokes `runcomfy run openai/gpt-image-2/<endpoint>` with a JSON body matching the schema above.2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/openai/gpt-image-2/<endpoint>` with the user's bearer token.3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 seconds.
SKILL.md:198In the instructionsOpen original file
4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose host ends with `.runcomfy.net` or `.runcomfy.com` into `--output-dir`. Other URLs are listed but not fetched.5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you stopped.
SKILL.md:102In the instructionsOpen original file
The CLI submits, polls every 2s until terminal, then downloads any `*.runcomfy.net` / `*.runcomfy.com` URL from the result into `--output-dir`. Stdout is the result JSON. Stderr is progress.

Inside this skill

8 instruction sections

This Skill does not call OpenAI directly. It uses the local RunComfy CLI to submit generation or editing requests to RunComfy's model API and poll for results.

View source
SKILL.md:194In the instructionsOpen original file
1. The skill invokes `runcomfy run openai/gpt-image-2/<endpoint>` with a JSON body matching the schema above.2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/openai/gpt-image-2/<endpoint>` with the user's bearer token.3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 seconds.4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose host ends with `.runcomfy.net` or `.runcomfy.com` into `--output-dir`. Other URLs are listed but not fetched.5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you stopped.

Editing accepts up to 10 publicly reachable HTTPS image URLs. RunComfy's server fetches those images, so processing is not confined to the user's device.

View source
SKILL.md:65In the instructionsOpen original file
| `prompt` | string | yes | — | Natural-language **edit instruction** || `images` | string[] | yes | — | **Up to 10** reference image URLs (publicly fetchable HTTPS) || `size` | enum | no | `auto` | `auto` (preserve input ratio), or one of the three fixed sizes above |
SKILL.md:209In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.

After completion, the CLI downloads results hosted on specified RunComfy domains into a caller-selected absolute path, with a 2 GiB limit per download.

View source
SKILL.md:102In the instructionsOpen original file
The CLI submits, polls every 2s until terminal, then downloads any `*.runcomfy.net` / `*.runcomfy.com` URL from the result into `--output-dir`. Stdout is the result JSON. Stderr is progress.
SKILL.md:211In the instructionsOpen original file
- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.
Start here · InstructionsSKILL.md
gpt-image-2
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 4 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:14In the instructionsOpen original file
  this model.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:20In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=gpt-image-2) · [Text-to-image](https://www.runcomfy.com/models/openai/gpt-image-2/text-to-image?utm_source=skills.sh&utm_medium=skill&utm_campaign=gpt-image-2) · [Edit](https://www.runcomfy.com/models/openai/gpt-image-2/edit?utm_source=skills.sh&utm_medium=skill&utm_campaign=gpt-image-2) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/gpt-image-2)
SKILL.md:86In the instructionsOpen original file
    "prompt": "<edit instruction>",    "images": ["https://..."]  }' \
Run commands
SKILL.md:24In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill gpt-image-2 -g
SKILL.md:74In the instructionsOpen original file
```bashruncomfy run openai/gpt-image-2/text-to-image \
SKILL.md:82In the instructionsOpen original file
```bashruncomfy run openai/gpt-image-2/edit \
Install extra software packages
SKILL.md:25In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill gpt-image-2 -g```
Lines read
212
File checksum (to compare versions)
523064ff41e962f7b9ad606f2964c5c91b69a8ed18f4ae663117be5759401080