Skip to content
skillsafebeta
← Report library
Purpose / Other

Gpt Image Edit Skill Security Audit

What the author says it does (original text)

>

Independent security check

Do not install or run it yet

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installation executes third-party npm packages and makes global changes

Source references: 3
What we found

The documentation requires globally installing `@runcomfy/cli` with npm and recommends globally adding the Skill through `npx skills add`. npm/npx can execute package installation scripts, while `-g` leaves persistent changes outside the current project. The supplied source does not include those packages' implementations for review.

Why this matters

If a package, dependency, or publisher account is compromised, installation could run arbitrary code with the current user's permissions, read accessible files or credentials, and persistently alter the global tooling environment.

The documentation requires a global third-party CLI installation and shows `npx` adding the Skill globally; both run or install third-party code outside the project directory. The supplied source does not include the CLI or installer implementation, so their install scripts and permission scope cannot be verified. Users can request pinned versions, inspect package contents, and install in an isolated environment.

SKILL.md:26In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill gpt-image-edit -g```
Show 2 other places
SKILL.md:45In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill gpt-image-edit -g```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

Images and edit instructions are disclosed to RunComfy's remote service

Source references: 3
What we found

For an edit, the CLI submits a JSON request containing the prompt and image URLs to RunComfy's Model API, and its servers fetch the images. The URLs must be publicly fetchable, which may require exposing otherwise private images at a publicly reachable location first.

Why this matters

Faces, product assets, unreleased advertising, brand material, credentials visible in images, or other sensitive content may leave the user's controlled environment and be processed by a third party. An unprotected public URL may also be accessible to anyone who learns or guesses it.

An edit sends the prompt and image URLs to RunComfy, whose server fetches the images. Requiring publicly fetchable URLs may require making private material accessible through a third-party-reachable link; exposure depends on the URL's access controls and lifetime. Users can limit use to non-sensitive images and ask about retention, training, and deletion policies.

SKILL.md:55In the instructionsOpen original file
|---|---|---|---|---|| `prompt` | string | yes | — | Edit instruction. Lead with preservation, end with the change. || `images` | string[] | yes | — | **Up to 10** publicly-fetchable HTTPS URLs. First is primary; rest are auxiliary. || `size` | enum | no | `auto` | `auto` (preserve input), `1024_1024` (1:1), `1024_1536` (2:3 portrait), `1536_1024` (3:2 landscape). |
Show 2 other places
SKILL.md:175In the instructionsOpen original file
The skill invokes `runcomfy run openai/gpt-image-2/edit` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/openai/gpt-image-2/edit`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:181In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.
Medium risk

The RunComfy API token is placed in a local file or process environment

Source references: 2
What we found

The login flow reportedly writes the API token to `~/.config/runcomfy/token.json`; the CI path instead uses a `RUNCOMFY_TOKEN` environment variable. Mode 0600 can exclude other ordinary local users, but it does not protect against malicious processes running as the same account, compromised dependencies, debug dumps, or unsafe CI logging.

Why this matters

A leaked token could let another party use the user's RunComfy identity, consume account quota, or create activity attributed to that account.

The Skill says login persistently writes the token under the user's configuration directory, or accepts it through an environment variable in CI. Mode 0600 limits access by other ordinary accounts, but same-user processes and unsafe CI logging may still expose it. Users can use a least-privilege revocable token, restrict environment propagation, and confirm logs redact it.

SKILL.md:46In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
Show 1 other places
SKILL.md:179In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 1
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The install command references a repository without pinning a commit, tag, or version, so the same command may retrieve changed upstream content later. A user can ask for an audited commit hash or fixed version and verify the source before installation.

SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill gpt-image-edit -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Low risk

Untrusted reference images may influence the requested edit

Source references: 2
What we found

The Skill explicitly accepts external image URLs and acknowledges image-based prompt injection as a known risk for image-editing models. A reference image containing hidden or misleading instructions could steer the result away from the user's written request; the visible instructions describe no sanitization or output-verification mechanism.

Why this matters

Generated images could contain unrequested text, branding, misleading alterations, or other unwanted content. Publishing them or making decisions from them without inspection could create reputational or business harm.

The Skill accepts external reference images and explicitly warns about image-based prompt injection. A malicious or misleading image could influence the generated result away from the user's instruction; the text does not show that this executes local code, nor does it describe automatic sanitization or output verification. Users can restrict inputs to trusted sources, inspect outputs, and avoid sensitive decisions based on unverified results.

SKILL.md:56In the instructionsOpen original file
| `prompt` | string | yes | — | Edit instruction. Lead with preservation, end with the change. || `images` | string[] | yes | — | **Up to 10** publicly-fetchable HTTPS URLs. First is primary; rest are auxiliary. || `size` | enum | no | `auto` | `auto` (preserve input), `1024_1024` (1:1), `1024_1536` (2:3 portrait), `1536_1024` (3:2 landscape). |
Show 1 other places
SKILL.md:181In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill itself contains instructions only; no CLI implementation is visible in the supplied source. It requires a third-party RunComfy CLI and uses that CLI to call a remote image-editing service. Claims about token protection, domain allowlisting, absence of telemetry, and download limits are therefore documentation claims that cannot be independently verified from the provided material.

View source
SKILL.md:45In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
SKILL.md:175In the instructionsOpen original file
The skill invokes `runcomfy run openai/gpt-image-2/edit` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/openai/gpt-image-2/edit`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:179In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.

An edit request sends the prompt and up to 10 publicly fetchable HTTPS image URLs to RunComfy's remote model API, after which results are downloaded into a user-selected directory.

View source
SKILL.md:55In the instructionsOpen original file
|---|---|---|---|---|| `prompt` | string | yes | — | Edit instruction. Lead with preservation, end with the change. || `images` | string[] | yes | — | **Up to 10** publicly-fetchable HTTPS URLs. First is primary; rest are auxiliary. || `size` | enum | no | `auto` | `auto` (preserve input), `1024_1024` (1:1), `1024_1536` (2:3 portrait), `1536_1024` (3:2 landscape). |
SKILL.md:175In the instructionsOpen original file
The skill invokes `runcomfy run openai/gpt-image-2/edit` with a JSON body matching the schema. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/openai/gpt-image-2/edit`, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
Start here · InstructionsSKILL.md
gpt-image-edit
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:16In the instructionsOpen original file
  "edit with gpt image 2", or any explicit ask to edit with this model.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:22In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=gpt-image-edit) · [Edit endpoint](https://www.runcomfy.com/models/openai/gpt-image-2/edit?utm_source=skills.sh&utm_medium=skill&utm_campaign=gpt-image-edit) · [Text-to-image sibling](https://www.runcomfy.com/models/openai/gpt-image-2/text-to-image?utm_source=skills.sh&utm_medium=skill&utm_campaign=gpt-image-edit) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/gpt-image-edit)
SKILL.md:69In the instructionsOpen original file
    "prompt": "Keep the person'\''s face, pose, and brand mark unchanged. Replace the background with a soft warm-grey studio sweep and a gentle floor shadow.",    "images": ["https://.../portrait.jpg"]  }' \
Run commands
SKILL.md:26In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill gpt-image-edit -g
SKILL.md:65In the instructionsOpen original file
```bashruncomfy run openai/gpt-image-2/edit \
SKILL.md:76In the instructionsOpen original file
```bashruncomfy run openai/gpt-image-2/edit \
Install extra software packages
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill gpt-image-edit -g```
Lines read
184
File checksum (to compare versions)
934438a4dfc8652b9eb3da6d19a58357c0cafa9cf38693d05c4e85c95acbdf68