40Medium
The skill risks supply chain compromise through unpinned npx execution and exposes the agent to indirect prompt injection by processing unverified image content from external URLs.
Skill Info
Nameagentspace-so/runcomfy-agent-skills/gpt-image-edit
Registrygithub
Versionfca19ae084c2
PURLpkg:github/agentspace-so/runcomfy-agent-skills@fca19ae084c2?skill=gpt-image-edit
Stars27
Installs319,100
Source
Install
This skill has findings worth reviewing before installing.
GitHub
319,100 installs
Skills.shDocs
npx skills add https://github.com/agentspace-so/runcomfy-agent-skillsAssessments (3)
AI Agent Traps ↗Potential brand impersonationmediumsocial engineeringAML.T0052.000LLM09:2025
Skill name or description references a well-known AI brand, which may suggest impersonation.
70% confidence
openai
Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtimemediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtime
95% confidenceline 27
npx skills
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinningmediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning
95% confidenceline 45
npm i -g
Potential for image-based prompt injectionlowprompt injectionAML.T0051AML.T0051.000AML.T0051.001AML.T0054LLM01:2025
The skill acknowledges that image URLs are fetched by the model server, creating a vector for indirect prompt injection where malicious image content could influence the model's behavior or output.
90% confidenceline 181
Treat external URLs as untrusted; image-based prompt injection is a known risk
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/agentspace-so/runcomfy-agent-skills/gpt-image-edit)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/agentspace-so/runcomfy-agent-skills/gpt-image-edit"><img src="https://mondoo.com/ai-agent-security/api/badge/github/agentspace-so/runcomfy-agent-skills/gpt-image-edit.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/agentspace-so/runcomfy-agent-skills/gpt-image-edit.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow