Add ComfyUI-SCAIL-Pose2 custom node

[rookiestar28]

Summary

Adds ComfyUI-SCAIL-Pose2 to custom-node-list.json as a git-clone installable custom node.

The entry follows the existing rookiestar28 records and points to:

• https://github.com/rookiestar28/ComfyUI-SCAIL-Pose2

Scope

ComfyUI-SCAIL-Pose2 provides SCAIL and SCAIL-2 pose/mask preprocessing nodes for ComfyUI, including DWPose-compatible pose data, NLF pose renders, condition metadata, and WanVideoWrapper adapter payloads.

Validation

• python json-checker.py custom-node-list.json
• git diff --check -- custom-node-list.json

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: dc8601e3-3524-4054-b21a-d8677a9e086e

📥 Commits

Reviewing files that changed from the base of the PR and between 3772432 and 40aa097.

📒 Files selected for processing (1)

• custom-node-list.json

---

📝 Walkthrough

Walkthrough

A single new entry for ComfyUI-SCAIL-Pose2 (id: comfyui-scail-pose2) is appended to custom-node-list.json, specifying its author, title, GitHub reference URL, git-clone install type, and a description of its pose/mask preprocessing capabilities.

Changes

ComfyUI-SCAIL-Pose2 Node Registry Entry

Layer / File(s)	Summary
New node entry custom-node-list.json	Appends an 11-line JSON object for ComfyUI-SCAIL-Pose2 with author, title, id (comfyui-scail-pose2), reference URL, git-clone install type, and a description covering SCAIL/SCAIL-2 pose/mask preprocessing, DWPose-compatible pose data, NLF pose renders, condition metadata, and WanVideoWrapper adapter payloads.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ltdrdata]

Thanks for the submission! A pre-registration security review flagged a path-handling issue that should be resolved before this can be added to the default channel.

In SaveNLFPosesAs3D, the filename_prefix input (a free-text widget) is joined onto the output directory without containment, so a crafted value can make the .glb write land outside ComfyUI's output/ folder. ComfyUI's built-in save nodes avoid this by routing the prefix through folder_paths.get_save_image_path(), which strips traversal and confines the write to the output tree.

Suggested fix: replace the raw os.path.join(get_output_directory(), filename_prefix) with folder_paths.get_save_image_path(filename_prefix, folder_paths.get_output_directory()) (or at minimum os.path.basename() plus a commonpath containment check).

Once updated, reply here and we'll re-review. Holding the PR open in the meantime — thanks for helping keep the ecosystem safe!

[rookiestar28]

Thanks for the submission! A pre-registration security review flagged a path-handling issue that should be resolved before this can be added to the default channel.

In SaveNLFPosesAs3D, the filename_prefix input (a free-text widget) is joined onto the output directory without containment, so a crafted value can make the .glb write land outside ComfyUI's output/ folder. ComfyUI's built-in save nodes avoid this by routing the prefix through folder_paths.get_save_image_path(), which strips traversal and confines the write to the output tree.

Suggested fix: replace the raw os.path.join(get_output_directory(), filename_prefix) with folder_paths.get_save_image_path(filename_prefix, folder_paths.get_output_directory()) (or at minimum os.path.basename() plus a commonpath containment check).

Once updated, reply here and we'll re-review. Holding the PR open in the meantime — thanks for helping keep the ecosystem safe!

Thanks for the review! This has been fixed. SaveNLFPosesAs3D now routes filename_prefix through folder_paths.get_save_image_path() and constructs the GLB filename from the sanitized basename it returns. Traversal and absolute-path prefixes are rejected before the exporter is invoked, while legitimate nested output prefixes remain supported. Regression tests and the full repository validation suite pass.