ComfyUI图像生成

提供基于 ComfyUI 的图像生成，强制使用正确提示词字段，避免重复生成，具备工作流与错误检查机制。

This skill appears to do what it says: edit ComfyUI workflows, submit them to a ComfyUI server, wait, and download images. Before using it: - Verify COMFYUI_SERVER is set to a ComfyUI instance you trust (the default is an internal IP); otherwise prompts and workflow JSONs can be transmitted to that server. - Review any workflow JSON files you point it at (they will be read and may include metadata or secrets). Avoid pointing it at system-wide config paths unless intended. - Use controlled output paths to avoid overwriting important files; the skill will create directories and write files with the specified names. - If you plan to run this in a multi-tenant or cloud environment, verify network access rules so the skill cannot talk to untrusted external endpoints. If you want a higher assurance review, provide the COMFYUI server address you plan to use and example workflow JSONs so I can check for sensitive fields that would be transmitted.

Type: OpenClaw Skill Name: tvdr-comfyui-gen Version: 1.0.0 The skill provides a functional interface for ComfyUI image generation but contains high-risk path traversal vulnerabilities. The `generate` and `download_image` functions in `__init__.py` and `comfyui_generator.py` accept an `output_path` parameter and perform file write/copy operations without sanitization, potentially allowing an attacker to overwrite arbitrary system files. Additionally, the code contains hardcoded internal IP addresses (192.168.18.15) and specific mount paths (/mnt/share2win), which are characteristic of environment-specific internal tools but pose a risk if deployed in untrusted environments.