Skip to content
skillsafebeta
← Report library
Purpose / Other

Relight Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Setup executes an unpinned third-party npm package

Source references: 2
What we found

`npm i -g` installs the package globally, while `npx -y` automatically fetches and runs it. Neither command pins a version or checksum, and the supplied material does not include the package implementation.

Why this matters

Install scripts and the CLI run with the invoking user's permissions. If the package, publisher account, or dependency supply chain is compromised, it could access or alter files and credentials available to that user; global installation also makes a lasting environment change.

The installation section explicitly recommends either a global install or automatic fetch-and-execution via `npx -y`, without a pinned version or digest. If run, the currently published third-party package executes with the user's privileges; the global option also changes the system-wide Node package environment. The package implementation is absent, so its behavior cannot be verified here. Users can ask for a pinned version, integrity verification, and audit evidence, and install it in an isolated environment.

SKILL.md:31In the instructionsOpen original file
```bash# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version
Show 1 other places
SKILL.md:168In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var in CI / containers.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Images and edit prompts are sent to RunComfy's remote model service

Source references: 3
What we found

The workflow submits its input to a Model API. Examples include an image URL and detailed prompt, so private photos, unreleased product images, or URLs carrying signed access parameters would leave the user's environment.

Why this matters

The remote service may receive the image contents, editing intent, and any access parameters embedded in the URL. The document claims restricted outbound domains and no telemetry, but no CLI implementation is supplied to independently verify those limits.

The active workflow sends the image location and edit prompt through the CLI to RunComfy's Model API, then polls and downloads the result. Private images, confidential prompts, or image URLs containing access credentials would therefore leave the local environment for third-party processing. Although the document claims an outbound-domain allowlist, it does not state remote retention, logging, or deletion policies. Users can ask for those policies and submit only material authorized for disclosure to RunComfy.

SKILL.md:80In the instructionsOpen original file
```bashruncomfy run qwen/qwen-edit-2509/lora/relight \  --input '{    "image": "https://your-cdn.example/product.jpg",    "prompt": "Relight as golden-hour studio: warm 3200K key light from camera-left at 45°, soft cool fill from right, no rim light, preserve product orientation and color identity."  }' \  --output-dir ./out```
Show 2 other places
SKILL.md:164In the instructionsOpen original file
The skill picks Qwen Edit Relight LoRA for dedicated lighting work, falls back to broader edit endpoints when relight is part of a composite pass. The CLI POSTs to the Model API, polls request status, and downloads the result into `--output-dir`.
SKILL.md:174In the instructionsOpen original file
  - When the relight diverges from the prompt, suspect the reference asset.- **Outbound endpoints (allowlist)**: only `model-api.runcomfy.net` and `*.runcomfy.net` / `*.runcomfy.com`. No telemetry.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB.
Low risk

Login persistently stores the RunComfy API token in the user's profile

Source references: 2
What we found

The documentation explicitly says `runcomfy login` saves the token to `~/.config/runcomfy/token.json`. Mode 0600 limits access by other ordinary system users, but software, malicious processes, or backups operating as the same account may still read it.

Why this matters

A leaked token could let another party use the user's RunComfy account and available quota until the token is revoked.

The documentation explicitly instructs users to sign in and states that login persistently stores the API token under the user's home directory. Mode 0600 blocks other ordinary OS accounts, but software running as the same user, processes after an account compromise, and some backups may still access it. Users can run this under an isolated account or container and ask about token scope, lifetime, and revocation; CI can use the documented environment variable instead of the persistent file.

SKILL.md:34In the instructionsOpen original file
# 2. Sign inruncomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>
Show 1 other places
SKILL.md:169In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var in CI / containers.- **Input boundary (shell injection)**: prompts and image URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content. **No shell-injection surface**.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill uses the RunComfy CLI to submit an image and text prompt to a third-party model API, poll the job, and download the generated result to a chosen output directory.

View source
SKILL.md:38In the instructionsOpen original file
# 3. Relightruncomfy run qwen/qwen-edit-2509/lora/relight \  --input '{"image": "...", "prompt": "..."}' \  --output-dir ./out```
SKILL.md:164In the instructionsOpen original file
The skill picks Qwen Edit Relight LoRA for dedicated lighting work, falls back to broader edit endpoints when relight is part of a composite pass. The CLI POSTs to the Model API, polls request status, and downloads the result into `--output-dir`.

The Skill routes dedicated relighting to Qwen Edit Relight and may route composite edits to other model endpoints. Its model-selection and identity-preservation descriptions are functional claims, not guarantees that people or product details will remain unchanged.

View source
SKILL.md:51In the instructionsOpen original file
**Qwen Edit 2509 Relight LoRA** — `qwen/qwen-edit-2509/lora/relight` *(default for dedicated relighting)*> Purpose-built relighting LoRA on Qwen Edit 2509. Tuned specifically for changing lighting direction, color temperature, intensity, and mood while preserving subject identity, pose, and framing.> Pick for: precise lighting control ("golden hour key light from left, soft fill from right, no rim"), brand product relighting, portrait mood shifts.> Avoid for: edits that aren't really about lighting — use generic image edit.
SKILL.md:103In the instructionsOpen original file
When Qwen Relight isn't a fit (e.g. composite edit with other changes), use **Nano Banana 2 Edit**:

The Skill requires installing a third-party npm CLI and signing in; its documentation says the login token is persisted in the user's configuration directory with mode 0600.

View source
SKILL.md:31In the instructionsOpen original file
```bash# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version# 2. Sign inruncomfy login              # or in CI: export RUNCOMFY_TOKEN=<token>
SKILL.md:169In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var in CI / containers.- **Input boundary (shell injection)**: prompts and image URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content. **No shell-injection surface**.
Start here · InstructionsSKILL.md
relight
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:3In the instructionsOpen original file
name: relightallowed-tools: Bash(runcomfy *)displayName: "Relight"
SKILL.md:30In the instructionsOpen original file
```bash# 1. Install (see runcomfy-cli skill for details)
SKILL.md:79In the instructionsOpen original file
```bashruncomfy run qwen/qwen-edit-2509/lora/relight \
Connect to websites
SKILL.md:18In the instructionsOpen original file
  explicit ask to alter how a still is lit.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:26In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=relight) · [Qwen Edit relight](https://www.runcomfy.com/models/qwen/qwen-edit-2509/lora/relight?utm_source=skills.sh&utm_medium=skill&utm_campaign=relight) · [CLI docs](https://docs.runcomfy.com/cli/introduction?utm_source=skills.sh&utm_medium=skill&utm_campaign=relight)
SKILL.md:43In the instructionsOpen original file
CLI deep dive: [`runcomfy-cli`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/runcomfy-cli) skill.
Install extra software packages
SKILL.md:32In the instructionsOpen original file
# 1. Install (see runcomfy-cli skill for details)npm i -g @runcomfy/cli      # or:  npx -y @runcomfy/cli --version
SKILL.md:168In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf**.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var in CI / containers.
Lines read
184
File checksum (to compare versions)
1cdfa7aa3cdae35acd2e3bab307718c19da31f8df8de095977f687947d5ed58c