360 Secure SkillHub
360 安全技能中心

Comfyui Local

该 Skill 调用本机或局域网内的 ComfyUI 服务，按 workflows/ 目录中的白名单工作流生成图像。命令行传入提示词、负面提示词、尺寸与工作流名，服务器地址只从环境变量读取，脚本以 JSON over HTTP 提交任务、轮询完成并下载结果图到 output 目录。

hypnotronic3
hypnotronic3
热度 57.80
最近更新 2026-07-12 14:12:48
分类：创作依赖：代码执行 / 读写文件 / 第三方 API应用场景：图像生成 / 工作流 / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add hypnotronic3/comfyui-local
Metadata
name
comfyui-local
description
Generate images using a local ComfyUI instance with hardcoded server address and allowlisted workflows. Secure by design — no arbitrary file reads, no arbitrary server connections, no shell injection. Requires a running ComfyUI server on the local network.
metadata
{"openclaw":{"emoji":"🎨","requires":{"env":["COMFYUI_SERVER_ADDRESS"]}}}

ComfyUI Local — Secure Image Generation

Generate images using your local ComfyUI instance. Designed with security as a priority:

  • Server address is configured, not passed as argument — no connecting to arbitrary servers
  • Workflows are allowlisted — only files in the workflows/ directory can be used
  • No shell injection surface — prompts are passed as JSON, never interpolated into shell commands
  • Path traversal blocked — ../ and absolute paths are rejected

Setup

  1. Server address: Set the COMFYUI_SERVER_ADDRESS environment variable (e.g., http://192.168.1.10:8188 or http://127.0.0.1:8188).
  2. ComfyUI API mode: Ensure "Enable Dev mode" is turned on in your ComfyUI settings.

Usage

Generate an image with a prompt

python3 {skillDir}/scripts/comfy_gen.py --prompt "a serene mountain lake at sunset"

Generate with a specific allowlisted workflow

python3 {skillDir}/scripts/comfy_gen.py --prompt "a cyberpunk cityscape" --workflow z-image-turbo

Generate with custom dimensions

python3 {skillDir}/scripts/comfy_gen.py --prompt "a cat in a spacesuit" --width 768 --height 512

Generate with negative prompt

python3 {skillDir}/scripts/comfy_gen.py --prompt "a portrait photo" --negative "blurry, distorted, low quality"

Available Workflows

Place API-format workflow JSON files in the workflows/ directory. They are automatically available by filename (without .json extension).

The included workflows:

Workflow Description
z-image-turbo Fast generation, 10 steps, Euler sampler
z-image-biglove Higher quality, more steps

Security Design

This skill fixes the three vulnerabilities found in other ComfyUI skills:

1. No arbitrary file reads

The original skill accepted --workflow /any/path/on/disk.json, allowing an agent to read any JSON file on the system. This version only allows workflows from the workflows/ directory within the skill folder. Paths with .., /, or \ are rejected.

2. No arbitrary server connections

The original skill accepted the server address as a command-line argument, allowing connections to any server. This version reads COMFYUI_SERVER_ADDRESS from the environment only. No command-line override.

3. No shell injection

The original skill constructed shell commands with user-provided arguments. This version uses argparse and passes all data as structured JSON over HTTP — no shell interpolation.

How It Works

  1. Reads COMFYUI_SERVER_ADDRESS from environment (required)
  2. Validates the workflow name against allowlisted files in workflows/
  3. Loads the workflow, injects the prompt and seed
  4. Sends the workflow to ComfyUI via HTTP API
  5. Polls for completion, downloads the result image
  6. Saves to {skillDir}/output/ and prints a MEDIA: path