All 67 static findings are false positives caused by Markdown formatting, example URLs, or documentation of credential storage. Separate review found shell-construction, unpinned dependency, and third-party media disclosure risks that require clear safeguards.
The examples embed generated prompt text inside single-quoted JSON passed through a shell. The skill lacks a mandatory serialization rule for arbitrary user-controlled characters.
The command examples directly place prompt text inside shell-quoted JSON, while line 222 asserts safety after shell parsing. Robust argument construction is not required.
The prerequisite installs the latest RunComfy CLI globally without a version pin. Package compromise or incompatible updates could execute code with user permissions.
Line 49 explicitly uses a global npm installation with no version. This is a clear dependency integrity and update risk.
All static alerts are Markdown syntax, placeholder URLs, documentation, or standard token storage guidance. The skill intentionally sends prompts and media locations to RunComfy, creating a third-party data disclosure risk.
The workflow sends prompts to RunComfy and directs its servers to fetch user-provided media URLs. Sensitive media or signed URLs may be disclosed to that service.
The documentation explicitly states that the CLI posts requests to the Model API and that RunComfy servers fetch supplied media URLs.
All static alerts are Markdown syntax, placeholder URLs, documentation, or standard token storage guidance. The skill intentionally sends prompts and media locations to RunComfy, creating a third-party data disclosure risk.
The workflow sends prompts to RunComfy and directs its servers to fetch user-provided media URLs. Sensitive media or signed URLs may be disclosed to that service.
The documentation explicitly states that the CLI posts requests to the Model API and that RunComfy servers fetch supplied media URLs.
All static alerts are Markdown syntax, placeholder URLs, documentation, or standard token storage guidance. The skill intentionally sends prompts and media locations to RunComfy, creating a third-party data disclosure risk.
The workflow sends prompts to RunComfy and directs its servers to fetch user-provided media URLs. Sensitive media or signed URLs may be disclosed to that service.
The documentation explicitly states that the CLI posts requests to the Model API and that RunComfy servers fetch supplied media URLs.