ComfyUI Custom Node Safety Scanner

[imprsnst]

🔐 Safety Scanner for ComfyUI Custom Nodes (Summary)

Custom nodes extend ComfyUI but introduce supply-chain risks such as malware, miners, and unsafe install scripts.
This proposal introduces a lightweight safety scanner to assess custom nodes before install or execution.

---

🎯 Goals

• Detect malicious or unsafe behavior early
• Improve trust and transparency
• Stay fast, local, and privacy-safe

---

🧩 Key Safety Checks

1️⃣ Static Code & File Scan

• Suspicious files (.exe, .dll, .so, .pyc)
• Obfuscated content
• Dangerous Python calls (exec, eval, subprocess, pickle.loads)
• Shell / PowerShell scripts

2️⃣ Dependency & Install Audit

• Unpinned or GitHub-based dependencies
• Install hooks in setup.py / pyproject.toml
• Runtime pip install usage

---

⚠️ Risk Scoring

Transparent risk score with clear actions:

Level	Action
🟢 Low	Allow
🟡 Medium	Warn
🔴 High	Block

---

🚀 MVP Scope

• Static scanning
• Dependency analysis
• Risk score + install warning

Designed to block most real-world malicious nodes with minimal complexity.

---

💬 Open Questions

• Block vs warn by default?
• False-positive tolerance?