Versioned security assessment

Report ID: SA-0519034D

7/9/2026, 12:16:17 PM

gpt-image-2 security assessment v5

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
gpt-image-2
Version
v5
Maintainer
runcomfy-com
Source
github.com/runcomfy-com/skills/tree/main/gpt-image-2/
Coverage
1 Files scanned · 212 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are Markdown formatting false positives, including endpoint names, prompt examples, and API path placeholders. I confirmed intended RunComfy CLI commands and outbound Model API requests. They execute local tools and send user data to RunComfy. No prompt injection text or covert malicious intent was found in SKILL.md.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 212 Lines analyzed

11 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 6 evidence locations

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 41 evidence locations

Capability review items (11)
Medium
SKILL.md:9-10
Ruby/shell backtick execution
(Flux 2 / Nano Banana Pro / Seedream) instead. Calls `runcomfy run
The front matter says the skill calls the local RunComfy CLI. That is intended behavior, but it executes a local binary and can transmit user prompts or images to RunComfy.
Medium
SKILL.md:10
Ruby/shell backtick execution
openai/gpt-image-2/text-to-image` or `/edit` through the local
The front matter continues the RunComfy CLI endpoint reference. This is intended, but local CLI execution and external model submission remain security-relevant.
Medium
SKILL.md:24-26
Ruby/shell backtick execution
```bash
The fenced shell example installs the skill globally with npx from a GitHub source. The command is user-initiated documentation, but it carries supply-chain and local execution risk if copied.
Medium
SKILL.md:45-46
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite tells users to install the RunComfy CLI globally with npm. This is expected setup, but global package installation executes third-party code on the user machine.
Medium
SKILL.md:46-47
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
The prerequisite runs the RunComfy login command. That starts a local authentication flow and creates credential-handling risk, even though it is expected for this service.
Medium
SKILL.md:74-78
Ruby/shell backtick execution
```bash
The text-to-image example runs the local RunComfy CLI with user prompt input and an output directory. This is the intended workflow, but it is real external command execution.
Medium
SKILL.md:82-89
Ruby/shell backtick execution
```bash
The edit example runs the local RunComfy CLI with an edit instruction and image URL. This can send user data to a third-party model endpoint.
Medium
SKILL.md:93-100
Ruby/shell backtick execution
```bash
The multi-reference edit example runs the RunComfy CLI with multiple image URLs. This is legitimate, but it executes a local command and submits external references.
Medium
SKILL.md:106-109
Ruby/shell backtick execution
```bash
The pipe-friendly example runs RunComfy and pipes output to jq. The pipeline is documented and bounded, but it is still shell command execution.
Medium
SKILL.md:194-195
Ruby/shell backtick execution
1. The skill invokes `runcomfy run openai/gpt-image-2/<endpoint>` with a JSON body matching the sche
The implementation description states that the skill invokes runcomfy run for GPT Image 2 endpoints. This confirms intentional local CLI execution as part of normal operation.
Low
SKILL.md:195
Hardcoded URL
2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/openai/gpt-image-2/<endpoint>` with th
The How it works section names the RunComfy Model API endpoint and says requests use the user bearer token. This is expected, but prompts, URLs, and auth metadata leave the local machine.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    The skill relies on local RunComfy CLI execution.
    Require explicit user confirmation before installation or RunComfy commands, and keep prompt data passed as structured JSON arguments.
  2. FIX-002
    Low
    Prompts, reference image URLs, and request metadata are sent to RunComfy.
    Keep the external data transfer disclosure visible, and warn users not to submit secrets or private image URLs.
  3. FIX-003
    Low
    RunComfy credentials may be stored on disk by the CLI.
    Document token revocation, logout behavior, and the RUNCOMFY_TOKEN option for ephemeral environments.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable