gpt-image-2

Static analysis flagged 77 patterns across SKILL.md (58 shell backticks, 10 hardcoded URLs, 5 filesystem paths, 3 weak-crypto indicators, 1 reconnaissance). All findings evaluated as false positives: backticks contain markdown CLI documentation examples, URLs are legitimate RunComfy service endpoints, filesystem references document CLI config paths (~/.config/runcomfy/token.json), and crypto/reconnaissance patterns are misidentified text ("Exit codes" heading, jq pipe examples). No executable code, no prompt injection, no data exfiltration detected. Minor concerns: user prompts transmitted to RunComfy's external API, third-party CLI dependency, local token file storage.