spark-comfy — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spark-comfy (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Spark Atlas is the Weblyfe fleet's on-prem DGX Spark inference box (Tailscale-only endpoint set by SPARK_BASE). It runs ComfyUI behind a FastAPI wrapper called spark-api on port 8190. Any Appie on the tailnet can render images by hitting it.
This skill is the client side: a thin Python helper and copy-paste curl examples.
curl -s $SPARK_BASE/health | jq .Should return {"status": "healthy", "comfyui": "connected", ...}.
~/.hermes/.env (or your shell env): SPARK_API_KEY=spark_<your-handle>_<hex>Seyed provisions keys via Spark's ~/.hermes/.env SPARK_API_KEYS list. Ask if you don't have one.
urllib, json, time, os). No extra installs needed.| Endpoint | Method | Auth | Purpose |
|---|---|---|---|
/health | GET | none | Quick liveness check |
/system | GET | none | Diagnostics (uptime, output dir, model count) |
/models | GET | none | List checkpoints + which models are downloaded |
/styles | GET | none | List style presets (cinematic, luxury, ...) |
/generate | POST | X-API-Key | Text-to-image |
/img2img | POST | X-API-Key | Image-to-image |
/upscale | POST | X-API-Key | Upscale an existing image |
/workflow | POST | X-API-Key | Raw ComfyUI workflow |
/status/{job_id} | GET | none | Job status |
/jobs | GET | none | Active job list |
/output/{path} | GET | none | Fetch a generated image file |
/docs | GET | none | Swagger UI |
max_concurrent = 2. Submit a third while two are running → 429 Max concurrent jobs reached.
# Health
curl -s $SPARK_BASE/health | jq .
# Generate with SDXL
JOB=$(curl -s -X POST $SPARK_BASE/generate \
-H "Content-Type: application/json" \
-H "X-API-Key: $SPARK_API_KEY" \
-d '{
"prompt": "luxury portrait of a confident woman, premium editorial",
"model": "sdxl",
"style": "cinematic"
}' | jq -r .job_id)
# Poll until done
while true; do
STATUS=$(curl -s "$SPARK_BASE/status/$JOB" | jq -r .status)
echo "$STATUS"
[[ "$STATUS" == "completed" || "$STATUS" == "failed" ]] && break
sleep 3
done
# Get the image URL
curl -s "$SPARK_BASE/status/$JOB" | jq -r '.image_urls[0]'
# → /output/job_xxx_SparkAtlas_..._00001.png
# Download it
curl -s -o out.png "$SPARK_BASE/output/job_xxx_..._00001.png"from spark_client import spark_generate
urls = spark_generate(
prompt="luxury Dubai penthouse balcony at golden hour, panoramic city view",
model="flux_schnell", # or "sdxl"
style="luxury",
)
print(urls[0])The spark_client.py helper lives next to this SKILL.md. Copy it into your skill's tools dir or import directly.
| Alias | Filename | Recommended params |
|---|---|---|
sdxl | sd_xl_base_1.0.safetensors | steps=24-30, cfg=5.0-7.0, euler/normal |
flux_schnell | flux_schnell_fp8.safetensors | steps=4, cfg=1.0, euler/simple |
Call /models to see the live list — new models added on Spark show up there automatically.
The style field appends a style tag block to your prompt. Available:
cinematic · natural · studio · fashion · luxury · vintage · minimalist · (and more — call /styles).
Set style: "" to skip preset and pass tags inline.
{
"prompt": "subject + scene description",
"negative_prompt": "low quality, blurry, deformed",
"model": "sdxl",
"style": "cinematic",
"width": 1024,
"height": 1024,
"steps": 24,
"cfg": 5.0,
"sampler": "euler",
"scheduler": "normal",
"seed": 42,
"return_url": true
}Only prompt is required.
active_jobs, available_models, total_generated.max_concurrent = 2. Queue locally above that.flux_schnell for fast iteration; sdxl for the final delivery.prompt + seed + model together. Reproducible.| HTTP | Cause | Fix |
|---|---|---|
401 Invalid or missing X-API-Key | Header missing on mutating call | Add -H "X-API-Key: $SPARK_API_KEY" |
429 Max concurrent jobs reached (2) | Queue full | Wait, or check /jobs for active work |
503 ComfyUI not reachable | ComfyUI process down on Spark | Page Seyed; check /health |
422 validation error | Bad request body | Check /docs for exact schema |
timeout >30s on /health | Network/Tailscale issue | tailscale ping <spark-tailscale-ip> |
SKILL.md — this filespark_client.py — Python helper (stdlib only)examples/ — sample prompts + workflows (TBD)docs/CLAUDE-CODE-PATH.md in the appie-kit for general Claude Code orchestrator setup.$SPARK_DOCS_DIR/spark-api-instructions.md on the Spark host.$SPARK_DOCS_DIR/operator-discipline.md.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.