gpt-image-edit
The skill risks supply chain compromise through unpinned npx execution and exposes the agent to indirect prompt injection by processing unverified image content from external URLs.
Skill Info
Install
npx skills add https://github.com/agentspace-so/runcomfy-agent-skillsAssessments (3)
AI Agent Traps ↗Skill name or description references a well-known AI brand, which may suggest impersonation.
openai
Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtime
npx skills
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning
npm i -g
The skill acknowledges that image URLs are fetched by the model server, creating a vector for indirect prompt injection where malicious image content could influence the model's behavior or output.
Treat external URLs as untrusted; image-based prompt injection is a known risk
Badge
[](https://mondoo.com/ai-agent-security/skills/github/agentspace-so/runcomfy-agent-skills/gpt-image-edit)<a href="https://mondoo.com/ai-agent-security/skills/github/agentspace-so/runcomfy-agent-skills/gpt-image-edit"><img src="https://mondoo.com/ai-agent-security/api/badge/github/agentspace-so/runcomfy-agent-skills/gpt-image-edit.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/agentspace-so/runcomfy-agent-skills/gpt-image-edit.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow