·
Last changedVersion:
This version passed the hardening gate. Hardening applied 5 targeted changes and preserved all other text. Classified findings before hardening: 1. Classified findings closed: 1. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 3. Review findings remaining: 9.
1
None
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Closed |
1 finding
Image edit, intent-routed. This skill doesn't lock you to one model — it picks the right edit model in the RunComfy catalog based on what the user actually wants: batch identity-preservation, multilingual text rewrite, single-shot precise edit, or mask-driven region replacement.
| User intent | Model | Why |
|---|---|---|
Batch edit 1–20 images consistently (SKU gallery, A/B variants) | Nano Banana Edit | Up to 20 input images per call; locked aspect/resolution for series |
Swap background, preserve subject identity | Nano Banana Edit | Strong identity preservation under "keep X unchanged" prompts |
Localized object removal / addition with spatial language ("the left object", "upper-right corner") | Nano Banana Edit | Honors directional spatial scope |
Multilingual / non-Latin in-image text rewrite (Japanese kana, Cyrillic, Arabic) | GPT Image 2 Edit | Strongest in class for multilingual typography |
Multi-reference composition (subject from img1, scene from img2, palette from img3) | GPT Image 2 Edit | Numbered refs route cues correctly |
Layout-precise repositioning ("move headline from top-right to bottom-center") | GPT Image 2 Edit | Directional language honored at layout level |
Identity preservation across translated headline variants | GPT Image 2 Edit | Same source asset → many language variants, identity stable |
Single-shot precise local edit ("she's now holding an orange umbrella") | Flux Kontext Pro | Single-ref single-instruction, high-fidelity preservation |
Mask-driven object removal (cables, watermarks, distractions) | Z-Image Turbo Inpaint | Mask-required, strength-tunable, edge-consistent |
Mask-driven region replacement (full background swap with mask) | Z-Image Turbo Inpaint | High strength + clean mask = clean replacement |
Default if unspecified | Nano Banana Edit | Most flexible, supports both single and batch |
The agent reads this table, classifies the user's intent, and picks the matching subsection below.
npm i -g @runcomfy/cliruncomfy login.RUNCOMFY_TOKEN=<token>.Model: google/nano-banana-2/edit
| Field | Type | Required | Default | Notes |
|---|---|---|---|---|
| string | yes | — | Lead with preservation goals, end with the change. |
| array | yes | — | 1–20 publicly-fetchable HTTPS URLs. |
| int | no | 1 | 1–4 outputs per call. |
| enum | no |
|
|
| enum | no |
|
|
| enum | no |
|
|
| int | no | — | Reproducibility. |
| bool | no | false | Web-grounded edits (extra latency). |
Batch (lock aspect + resolution):
"Keep [identity / pose / brand / framing] unchanged." Then state the change.aspect_ratio and resolution across the batch.Model: openai/gpt-image-2/edit
| Field | Type | Required | Default | Notes |
|---|---|---|---|---|
| string | yes | — | Edit instruction; lead with preservation. |
| string[] | yes | — | Up to 10 HTTPS URLs. First is primary; rest are auxiliary. |
| enum | no |
|
|
Multilingual text rewrite:
Multi-ref composition:
"Japanese kana", "Cyrillic", "Arabic right-to-left"."subject from image 1, lighting from image 2"."move the headline from top-right to bottom-center", "replace the watermark in the bottom-right".size: "auto" preserves input ratio — recommended unless the edit changes framing.Model: blackforestlabs/flux-1-kontext/pro/edit
| Field | Type | Required | Notes |
|---|---|---|---|
| string | yes | One declarative edit instruction. |
| string | yes | Single source image URL. |
| enum | no | Pick from supported W:H values. |
| int | no | Reproducibility. |
Single image only — no array. For multi-image flows, use Route 1 (Nano Banana Edit).
"Keep [unchanged elements]" then state the change.Model: tongyi-mai/z-image/turbo/inpainting
| Field | Type | Required | Notes |
|---|---|---|---|
| string | yes | What to fill / replace; preservation constraints for the unmasked surround. |
| string | yes | Source image URL. |
| string | yes | Grayscale mask URL (white = inpaint, black = preserve). |
| float | no | 0.3–0.6 retouching, 0.7–1.0 full replacement. |
| float | no | 0.6–0.9 typical. |
| enum | no | W:H output ratio. |
| int | no | Reproducibility. |
Object removal (low strength):
Region replacement (high strength):
0.3–0.5 for retouching / cleanup, 0.6–0.7 for object replacement with style match, 0.8–1.0 for full-region replacement."preserve rooflines and sky gradient", "match brick pattern and mortar tone"."the left shelf", "upper-right quadrant".| code | meaning |
|---|---|
0 | success |
64 | bad CLI args |
65 | bad input JSON / schema mismatch |
69 | upstream 5xx |
75 | retryable: timeout / 429 |
77 | not signed in or token rejected |
Full reference: docs.runcomfy.com/cli/troubleshooting.
The skill picks one of Nano Banana Edit / GPT Image 2 Edit / Flux Kontext Pro / Z-Image Turbo Inpaint based on user intent and invokes runcomfy run <model_id> with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any .runcomfy.net/.runcomfy.com URL into --output-dir. Ctrl-C cancels the remote request before exit.
runcomfy login writes the API token to ~/.config/runcomfy/token.json with mode 0600 (owner-only read/write). Set RUNCOMFY_TOKEN env var to bypass the file entirely in CI / containers.--input.model-api.runcomfy.net (request submission) and *.runcomfy.net / *.runcomfy.com (download whitelist for generated outputs).Get started with chainctlchainctl skill install public/runcomfy-com/image-edit:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/runcomfy-com/image-edit:latest
MIT
HARDENING.md
LICENSE
SKILL.md