Skip to content
skillsafebeta
← Report library
Purpose / Other

Image Outpainting Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The installation step executes an unpinned third-party npm package locally

Source references: 2
What we found

The instructions recommend either globally installing `@runcomfy/cli` or fetching and executing it through `npx -y`. No package version is pinned, and the global option modifies a Node package location outside the current project.

Why this matters

If the current package release, a dependency, or its npm publishing account is compromised, installation or runtime code could access files, environment variables, and credentials with the invoking user's permissions. An unpinned command can also execute different code over time.

The installation instructions actively recommend either a global install or fetching and executing `@runcomfy/cli` through `npx -y`, with neither command pinning a version. Execution therefore trusts whichever package npm currently resolves, while the global form modifies a Node package location outside the project. This is a conventional installation method, but it creates supply-chain and version-drift risk. Users can ask for a verified exact version and integrity information and test it in an isolated environment.

SKILL.md:32In the instructionsOpen original file
```bash# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version# 2. Sign inruncomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>
Show 1 other places
SKILL.md:177In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var in CI / containers.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Source images, reference-image locations, and prompts are sent to remote RunComfy services

Source references: 3
What we found

The command places prompts and image URLs in the input JSON, and the CLI then POSTs the job to a remote Model API. A reference-driven route may involve multiple images. Processing therefore does not remain solely on the user's computer.

Why this matters

For private photos, unreleased product images, client assets, or URLs containing access credentials, the remote service receives the prompt and image location and may need to retrieve the corresponding image content.

The live workflow puts prompts and image URLs into JSON, and the CLI POSTs it to RunComfy's remote Model API; the reference-matching route can use up to 10 images. Thus, source/reference image locations and editing instructions leave the local machine for third-party processing. Before using private or restricted images, the user should confirm RunComfy's retention, training-use, and access-control policies and provide only content authorized for upload.

SKILL.md:40In the instructionsOpen original file
# 3. Outpaintruncomfy run google/nano-banana-2/edit \  --input '{"prompt": "...extend canvas...", "image_urls": ["..."]}' \  --output-dir ./out```
Show 2 other places
SKILL.md:58In the instructionsOpen original file
**GPT Image 2 Edit** — `openai/gpt-image-2/edit`> Up to 10 reference images, layout-precise instruction following. Useful when outpainting needs to match a reference style or includes layout repositioning.> Pick for: composite outpaint (extend canvas + paste in element from another image), layout repositioning during the canvas change.> Avoid for: simple outpaint without external references.
SKILL.md:173In the instructionsOpen original file
The skill classifies user intent — simple aspect-ratio swap, reference-style match, or brand-locked continuation — picks the matching edit endpoint, and invokes `runcomfy run` with the outpaint-shaped JSON body. The CLI POSTs to the Model API, polls request status, and downloads the result into `--output-dir`.
Low risk

The RunComfy account token persists on disk or is exposed to a process environment

Source references: 2
What we found

Login writes the API token to `~/.config/runcomfy/token.json`; the CI alternative supplies it through `RUNCOMFY_TOKEN`. Mode 0600 limits other local users but does not protect against malicious processes running as the same user, backups, or accidental environment logging.

Why this matters

If exposed, the token could let its holder call the service as the user. The provided file does not state the token's scope or possible billing impact.

The skill requires authentication and states that interactive login persists the API token in a configuration file under the user's home directory, while CI/containers may supply it through an environment variable. Mode 0600 limits direct access by other local accounts, but same-user processes may still read the file, and authorized child processes may inherit the environment variable. Users can restrict the account, processes, and CI-log access involved and ask about token scope, lifetime, and revocation.

SKILL.md:36In the instructionsOpen original file
# 2. Sign inruncomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>
Show 1 other places
SKILL.md:178In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var in CI / containers.- **Input boundary (shell injection)**: prompts and image URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content. **No shell-injection surface**.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill sends outpainting jobs to RunComfy's remote Model API and downloads generated results to a user-selected output directory; this is not a fully local image-processing workflow.

View source
SKILL.md:173In the instructionsOpen original file
The skill classifies user intent — simple aspect-ratio swap, reference-style match, or brand-locked continuation — picks the matching edit endpoint, and invokes `runcomfy run` with the outpaint-shaped JSON body. The CLI POSTs to the Model API, polls request status, and downloads the result into `--output-dir`.

Use requires installing a third-party CLI and signing in. The login token is stored in the user's configuration directory with mode 0600, or it may be supplied through an environment variable.

View source
SKILL.md:34In the instructionsOpen original file
# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version
SKILL.md:36In the instructionsOpen original file
# 2. Sign inruncomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>
SKILL.md:178In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var in CI / containers.- **Input boundary (shell injection)**: prompts and image URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content. **No shell-injection surface**.

The Skill selects different remote models for simple extension, reference-style matching, or brand continuation; the GPT Image route can use up to 10 reference images.

View source
SKILL.md:58In the instructionsOpen original file
**GPT Image 2 Edit** — `openai/gpt-image-2/edit`> Up to 10 reference images, layout-precise instruction following. Useful when outpainting needs to match a reference style or includes layout repositioning.> Pick for: composite outpaint (extend canvas + paste in element from another image), layout repositioning during the canvas change.> Avoid for: simple outpaint without external references.
SKILL.md:173In the instructionsOpen original file
The skill classifies user intent — simple aspect-ratio swap, reference-style match, or brand-locked continuation — picks the matching edit endpoint, and invokes `runcomfy run` with the outpaint-shaped JSON body. The CLI POSTs to the Model API, polls request status, and downloads the result into `--output-dir`.
Start here · InstructionsSKILL.md
image-outpainting
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:3In the instructionsOpen original file
name: image-outpaintingallowed-tools: Bash(runcomfy *)displayName: "Image Outpainting"
SKILL.md:32In the instructionsOpen original file
```bash# 1. Install (see runcomfy-cli skill for details)
SKILL.md:82In the instructionsOpen original file
```bashruncomfy run google/nano-banana-2/edit \
Connect to websites
SKILL.md:20In the instructionsOpen original file
  existing still.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:28In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-outpainting) · [best-image-editing-models](https://www.runcomfy.com/models/collections/best-image-editing-models?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-outpainting) · [CLI docs](https://docs.runcomfy.com/cli/introduction?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-outpainting)
SKILL.md:45In the instructionsOpen original file
CLI deep dive: [`runcomfy-cli`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/runcomfy-cli) skill.
Install extra software packages
SKILL.md:34In the instructionsOpen original file
# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version
SKILL.md:177In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var in CI / containers.
Lines read
194
File checksum (to compare versions)
c3289d4aa628d61dca3f1aaa8f40bfae89aa5e9791da12cce7017f09244c38a8