Analyze Workflow (TensorTrap)

The pitch

When someone hands you a ComfyUI workflow - a JSON off Civitai, Discord, or a Reddit thread - they're handing you a program. Every node in it runs as your user, with full access to your machine. ComfyUI doesn't sandbox any of it. The June 2024 ComfyUI_LLMVISION incident (the one that ended with a Disney breach and a federal conviction) proved what a malicious node looks like; a malicious graph is the subtler version of the same trick. The nodes themselves can be perfectly boring - the attack lives in how they're wired and what values are sitting in their widgets.

Analyze Workflow (TensorTrap) reads the graph you're about to run and looks for threat patterns before anything executes. It's the "what did I just download" check, in node form.

How it works

When you queue, ComfyUI hands the node its own execution graph, and TensorTrap's analyzer walks the node connections hunting for the patterns that actually hurt people:

• Known dangerous node types - eval-injection nodes carrying CVE-2024-21576 and CVE-2024-21577 (the Bmad-Nodes / ACE_ExpressionEval family)
• Data flows where a string output feeds a node that evaluates it
• URLs embedded in download nodes
• Pickle-deserializer abuse (CWE-502) - the poster child is RES4LYF's Base64ToConditioning holding a literal payload in the workflow JSON, the exact attack pattern from RES4LYF issue #252. That's CRITICAL. Wiring Base64ToConditioning from anything other than a ConditioningToBase64 in the same graph is MEDIUM - probably legitimate, but verify it
• Base64-encoded pickle smuggled into a plain string widget
• Sensitive filesystem paths in widget values (/etc/passwd, ~/.ssh/id_rsa, credential paths, deep ../ traversal)
• Code-shaped strings (__reduce__, __class__.__bases__, pickle.loads, compile())

It parses the graph JSON and reasons over it; it never executes the nodes to do so. That's the nice property of a workflow-level scan - the analysis runs, and any malicious node code doesn't.

The inputs and outputs that matter

Only two inputs, both optional:

• block_on_threat (default true) - when a finding meets your threshold, the node raises and stops the queue before the rest of the graph runs. Flip it to false to get the report without blocking.
• min_severity (default HIGH) - the cutoff: CRITICAL / HIGH / MEDIUM / LOW. HIGH is a sensible default; MEDIUM is paranoid mode.

Outputs:

• analysis_report - a STRING you wire to any Show Text / Display String node. This is the report.
• is_safe - a BOOLEAN, handy for a Conditional.
• findings_count - an INT, the number of findings.

How to install it

Install the whole pack once; the other three nodes come with it:

cd ComfyUI/custom_nodes
git clone https://github.com/realmarauder/ComfyUI-TensorTrap.git
pip install tensortrap

Restart ComfyUI, or just search "TensorTrap" in ComfyUI Manager and click install. All four nodes live under TensorTrap/Security. The graph analyzer is bundled inside the pack, so this node works even if the tensortrap CLI package isn't installed - that dependency only matters for the model-scanning node.

Where people get burned

• The block. If the queue dies with "TensorTrap blocked workflow", the exception names the exact node type and node id that fired. You can set block_on_threat=False or raise min_severity to run anyway - but actually read the finding first. That's the whole point of the node.
• "No workflow data available" means the node ran without ComfyUI handing it the live graph, which happens on some API/frontend call paths. Queue it from the ComfyUI UI and it reads the graph fine.
• False positives are real. A MEDIUM finding on a legitimately-wired Base64ToConditioning isn't an attack, it's "verify this." And a workflow that legitimately mentions pickle.loads in a text field will get flagged as a code-shaped string. Read the report, don't just trust the count.