Skip to content
skillsafebeta
← Report library
Purpose / Other

Image Edit Skill Security Audit

What the author says it does (original text)

>

Independent security check

Do not install or run it yet

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installation runs and installs third-party npm software globally

Source references: 4
What we found

The documentation requires a global `npm i -g` installation of the RunComfy CLI and shows `npx` adding the Skill globally from a GitHub repository. npm installation can run package-supplied lifecycle scripts, and global installation leaves executables and persistent changes in the current user's environment. The supplied source does not include those dependencies' implementations, so their actual behavior cannot be verified here.

Why this matters

If a downloaded package, dependency, or publisher account is compromised, installation-time code could read files and credentials available to the current user and alter that user's development environment.

The document gives two global installation operations: using `npx` to add a skill from a third-party GitHub repository and using `npm -g` to install the RunComfy CLI. Following them installs and runs third-party software whose implementation is absent from this material, so any install scripts or other behavior cannot be verified here. Users can request pinned versions, complete dependency source, and release checksums, and test in an isolated low-privilege environment.

SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-edit -g```
Show 3 other places
SKILL.md:50In the instructionsOpen original file
## Prerequisites1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login`.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.
SKILL.md:29In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-edit -g```
SKILL.md:52In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login`.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
High risk

Images, masks, and edit instructions are disclosed to the third-party RunComfy service

Source references: 4
What we found

The CLI sends JSON containing the edit prompt and input URLs to the RunComfy Model API, and RunComfy's servers fetch the images and masks. The requirement for “publicly-fetchable” URLs may also make inputs accessible without local-machine permission to anyone who obtains the address.

Why this matters

RunComfy and the image-hosting provider may receive faces, client assets, unreleased products, document screenshots, location data, or credentials embedded in an image. Public URLs further increase the chance of unintended access.

When an edit runs, the prompt and input URLs are sent to RunComfy's Model API, while its servers fetch the images and masks. Thus image content, masks, and editing text leave the device for third-party processing. The Nano Banana route explicitly requires publicly fetchable HTTPS URLs, which may broaden access to anyone who knows a URL. Users can ask about retention, training, and deletion policies and submit only authorized, non-sensitive material.

SKILL.md:67In the instructionsOpen original file
| `prompt` | string | yes | — | Lead with preservation goals, end with the change. || `image_urls` | array | yes | — | **1–20** publicly-fetchable HTTPS URLs. || `number_of_images` | int | no | 1 | 1–4 outputs per call. |
Show 3 other places
SKILL.md:195In the instructionsOpen original file
|---|---|---|---|| `prompt` | string | yes | What to fill / replace; preservation constraints for the unmasked surround. || `image` | string | yes | Source image URL. || `mask_image` | string | yes | **Grayscale mask URL** (white = inpaint, black = preserve). || `strength` | float | no | 0.3–0.6 retouching, 0.7–1.0 full replacement. |
SKILL.md:262In the instructionsOpen original file
The skill picks one of Nano Banana Edit / GPT Image 2 Edit / Flux Kontext Pro / Z-Image Turbo Inpaint based on user intent and invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:268In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 1
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The global install command names a GitHub repository and skill but pins no version, tag, or commit hash. If a user runs it later, changed repository contents could result in code different from the material audited here. The user can ask for a fixed commit or signed release and verify the source before installation.

SKILL.md:29In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-edit -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill selects one of four RunComfy-hosted models based on the editing intent, then uses a local CLI to submit and poll the request and download generated files to a chosen directory.

View source
SKILL.md:262In the instructionsOpen original file
The skill picks one of Nano Banana Edit / GPT Image 2 Edit / Flux Kontext Pro / Z-Image Turbo Inpaint based on user intent and invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.

Input images are not processed only on the local machine: several routes require HTTPS image or mask URLs, which are fetched by RunComfy's servers.

View source
SKILL.md:67In the instructionsOpen original file
| `prompt` | string | yes | — | Lead with preservation goals, end with the change. || `image_urls` | array | yes | — | **1–20** publicly-fetchable HTTPS URLs. || `number_of_images` | int | no | 1 | 1–4 outputs per call. |
SKILL.md:117In the instructionsOpen original file
| `prompt` | string | yes | — | Edit instruction; lead with preservation. || `images` | string[] | yes | — | **Up to 10** HTTPS URLs. First is primary; rest are auxiliary. || `size` | enum | no | `auto` | `auto`, `1024_1024`, `1024_1536`, `1536_1024`. **Only these.** |
SKILL.md:196In the instructionsOpen original file
| `prompt` | string | yes | What to fill / replace; preservation constraints for the unmasked surround. || `image` | string | yes | Source image URL. || `mask_image` | string | yes | **Grayscale mask URL** (white = inpaint, black = preserve). || `strength` | float | no | 0.3–0.6 retouching, 0.7–1.0 full replacement. |
SKILL.md:268In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.

Using the Skill requires a RunComfy account and API credential; interactive login stores the token in the user's configuration directory, while CI usage reads it from an environment variable.

View source
SKILL.md:52In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login`.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.
SKILL.md:266In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.
Start here · InstructionsSKILL.md
image-edit
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:18In the instructionsOpen original file
  of images.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:24In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-edit) · [Nano Banana Edit](https://www.runcomfy.com/models/google/nano-banana-2/edit?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-edit) · [GPT Image 2 Edit](https://www.runcomfy.com/models/openai/gpt-image-2/edit?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-edit) · [Flux Kontext](https://www.runcomfy.com/models/blackforestlabs/flux-1-kontext-pro/image-to-image?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-edit) · [Z-Image Inpaint](https://www.runcomfy.com/models/tongyi-mai/z-image/turbo/inpainting?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-edit) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/image-edit)
SKILL.md:81In the instructionsOpen original file
    "prompt": "Keep the subject identity, pose, and clothing unchanged. Convert the background into a rainy neon cyberpunk street.",    "image_urls": ["https://.../portrait.jpg"]  }' \
Run commands
SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-edit -g
SKILL.md:77In the instructionsOpen original file
```bashruncomfy run google/nano-banana-2/edit \
SKILL.md:88In the instructionsOpen original file
```bashruncomfy run google/nano-banana-2/edit \
Install extra software packages
SKILL.md:29In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-edit -g```
Lines read
271
File checksum (to compare versions)
e00b0a73bc3a5cccef65f64548af88b2fbe12fc85534341a3d4ce90e3342e663