·
Last changedVersion:
This version passed the hardening gate. Hardening applied 15 targeted changes and preserved all other text. Classified findings before hardening: 1. Classified findings closed: 1. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 11. Review findings remaining: 0.
1
None
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Closed |
1 finding
Black Forest Labs' Flux 1 Kontext Pro — single-reference precise local image edit — hosted on the RunComfy Model API. Strong prompt control, consistent outputs, high fidelity.
| You want | Use |
|---|---|
Single-image precise local edit ("she's now holding X") | Flux Kontext |
High-fidelity preservation of source identity | Flux Kontext |
Batch edits across 1–20 images | Nano Banana Edit |
Edit multilingual / embedded text in image | GPT Image 2 edit |
Generate from scratch, no source image | Flux 2 Klein |
If the user explicitly asks to edit an image with "Flux Kontext" or "BFL Kontext", route here. Each run is a billable remote job, so confirm with the user before starting one.
npm i -g @runcomfy/cli) or get their explicit approval before running that global install. The package is not pinned to a version, so ask the user to confirm the package source and version before installing.runcomfy login opens a browser device-code flow.RUNCOMFY_TOKEN=<token> instead of runcomfy login, injected from a secret store with log masking.--input body. Refer to it only by name.blackforestlabs/flux-1-kontext/pro/edit| Field | Type | Required | Default | Notes |
|---|---|---|---|---|
| string | yes | — | Single declarative edit instruction. |
| string | yes | — | Single source image URL (publicly fetchable HTTPS). |
| enum | no | (input) | Pick from supported W:H options on the model page. |
| int | no | — | Reuse for variant comparisons. |
The schema is intentionally minimal — Kontext leans on prompt + single ref. For multi-image or web-grounded edits, route to Nano Banana Edit.
Before each run:
--output-dir, keep existing files intact, and tell the user where the outputs were saved.Default — local edit, preserve everything else:
With seed for reproducible variant series:
One declarative instruction. Kontext shines on prompts shaped like the docs example: "She is now holding an orange umbrella and smiling". Imperative mood, single change.
Preservation first. Lead with "Keep [identity / pose / framing / brand] unchanged." Then the change. Models honor what's stated up front.
Single ref only — pick the right one. No multi-image fanout here. If you have multiple references, decide which is primary and pass that one. For multi-image flows, route to Nano Banana Edit.
Iterate on small changes. If Kontext drifts, split a compound edit into sequential single-instruction passes (pass 1: change background, pass 2: change clothing).
Aspect ratio — pick from the supported enum. Out-of-list values 422 or crop.
Anti-patterns:
| Use case | Why Flux Kontext |
|---|---|
Single-shot precise local edit | Specifically designed for this; high fidelity |
Preserve source identity through targeted change | Strong preservation under explicit instruction |
Brand-asset text or color swap | Quoted text + preservation lead-in works well |
Quick iteration on one image | Short prompts + single ref = fast result loop |
Page example:
Preservation-led brand edit:
Compositional micro-edit:
| code | meaning |
|---|---|
0 | success |
64 | bad CLI args |
65 | bad input JSON / schema mismatch |
69 | upstream 5xx |
75 | retryable: timeout / 429 |
77 | not signed in or token rejected |
Full reference: docs.runcomfy.com/cli/troubleshooting.
The skill invokes runcomfy run blackforestlabs/flux-1-kontext/pro/edit with a JSON body matching the schema. The CLI POSTs to https://model-api.runcomfy.net/v1/models/blackforestlabs/flux-1-kontext/pro/edit, polls the request, fetches the result, and downloads any .runcomfy.net/.runcomfy.com URL into --output-dir. Ctrl-C cancels the remote request before exit.
runcomfy login writes the API token to ~/.config/runcomfy/token.json with mode 0600 (owner-only read/write). Set RUNCOMFY_TOKEN env var to bypass the file entirely in CI / containers. Keep the token and the token file contents out of output and logs.--input. The shell parses the command line before the CLI runs, so prompt text must stay correctly escaped inside the quoted argument. Build and escape the JSON body as described in How to invoke.model-api.runcomfy.net (request submission) and *.runcomfy.net / *.runcomfy.com (download whitelist for generated outputs). No telemetry, no callbacks. After download, confirm each file is an expected image type from one of the RunComfy hosts listed here, and treat downloaded files as data, opening them only as images.Get started with chainctlchainctl skill install public/runcomfy-com/flux-kontext:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/runcomfy-com/flux-kontext:latest
MIT
HARDENING.md
LICENSE
SKILL.md