Manual review request for flagged comfyui-mrln-nodes 0.1.1

[master-merlin]

Node: comfyui-mrln-nodes · publisher master-merlin · version 0.1.1
Status: NodeVersionStatusFlagged (the node itself is NodeStatusActive)

Requesting manual review. This is the pack's first release and every scanner finding is severity: info.

The findings, and what each one is

Retrieved via GET /nodes/comfyui-mrln-nodes/versions?include_status_reason=true — six findings, all severity: info, all from yara_scan:

Rule	Where	What it actually is
python_network_operations ×5	promptapi/civitai.py, intake.py, llm.py, lora.py, thumbs.py	urllib.request calls behind three user-invoked features: Civitai lookup/download, the local-or-cloud LLM backend, and preview-image fetch
python_environment_manipulation ×1	promptlib/library.py	a single os.environ.get("MRLN_PROMPT_DIR") — an optional read used by the test suite to relocate the user directory. Nothing is ever set

The credential-access tag on the civitai.py match is an Authorization: Bearer header two lines above the call — the user's own optional Civitai key, sent as a header specifically so it cannot land in a URL, a log or a redirect.

Why these cannot be removed

They are the features, not a side effect of them. A prompt pack that looks up a LoRA's trigger words by hash, or sends a prompt to the Ollama instance the user configured, makes HTTP requests by definition. Hiding the calls from the scanner would be obfuscation, which your standards prohibit — so the code ships readable and documented instead.

Evidence

• SECURITY.md — every outbound request with its host, trigger, payload and auth.
• No eval, no exec, no subprocess, no os.system, no runtime package installation, no obfuscation, no telemetry.
• Zero runtime dependencies — requirements.txt is empty on purpose.
• LLM backend URLs are loopback-only by default; a non-loopback URL is refused at save time and at every use, credentials embedded in a URL are rejected, and enabling remote is an explicit armed opt-in. Pinned by tests/test_security_ssrf.py (14 cases).
• API keys are stored server-side only, never in a node widget (widget values persist into saved workflow PNGs), never echoed by any endpoint, and scrubbed out of every error and log line. Pinned by tests/test_security_secrets.py (12 cases).
• Imported bundles are treated as untrusted input: path traversal, NUL truncation, Windows reserved names and absolute paths are all refused, and a download is gated on a real Civitai AIR so a bundle cannot aim a fetch at an arbitrary host. Pinned by tests/test_prompt_bundle_hardening.py (44 cases).
• CI runs ruff + 2030 Python tests + 534 JS tests on Python 3.10 / 3.12 / 3.13.

Secondary observation: the discoverability effect

Related to #195, but a different case — and it hits every first release:

When a node's only version is flagged, the node record returns latest_version: null and the node does not appear in GET /nodes?search=… at all. Searching comfyui-mrln-nodes, MRLN Nodes and mrln each returns results without it. The CDN artifact serves fine (.../0.1.1/node.zip → HTTP 200), so the package is installable by id while being undiscoverable in ComfyUI Manager.

If that is intended for flagged versions, please disregard. If not, a new publisher's first release is invisible until a human clears it, which may explain the number of similar requests here.

Happy to provide anything else useful.