ComfyUI UniRig - Moses Yebei

The Problem

Character rigging in ComfyUI has historically meant either sending meshes to external tools like Blender or Mixamo, or using rigid, single-purpose auto-riggers. UniRig (SIGGRAPH 2025) and Make it Animatable (CVPR 2025) both solve automatic skeleton extraction and skinning, but neither ships as a ComfyUI node. This wrapper puts those research models behind ComfyUI nodes so artists can rig, skin, pose, and export characters without leaving the graph.

What This Does

ComfyUI-UniRig wraps two model families: nodes/mia/ (Make it Animatable) for humanoid characters, and nodes/unirig/ for general skeletons. The nodes/animation.py, nodes/skinning.py, and nodes/auto_rig.py files expose the core node logic. The repo bundles Blender (nodes/unirig/direct_export_fbx.py uses bpy for FBX export) and downloads model weights on demand via nodes/unirig/download.py. Six example workflows under workflows/ show humanoid rigging, bird rigging, and animation application.

How It Is Wired

Execution starts at execute in nodes/animation.py:116, which routes through 118 functions. That function calls _mm (15 call sites) and exists (20 call sites) — these two utility functions are the widest blast radius in the codebase; changing them breaks the most callers. The nodes/mia/utils.py file carries the heaviest load: 71 functions and 5 classes, including _mm, _standardize_quaternion, and _quaternion_to_matrix. nodes/mia/models_ae.py provides exists, default, and cache_fn, used across 8 files.

The module graph shows nodes/base and nodes/unirig/__init__ as pure sinks (instability 0) — safe to change. nodes/load_model sits at 0.6 instability, caught between callers and model loading. No circular dependencies exist across 46 modules, so refactoring is not blocked by cycles.

A full run touches the filesystem via models_dir.mkdir in download, and nodes/unirig/direct_export_fbx.py reads/writes files and a database. Inference happens in nodes/mia/model.py and nodes/unirig/direct.py. The shortest path from entry to external effect is execute -> download, two hops.

How To Use It

Setup (from README):

cd ComfyUI/custom_nodes
git clone https://github.com/PozzettiAndrea/ComfyUI-UniRig.git
cd ComfyUI-UniRig
pip install -r requirements.txt --upgrade
python install.py

The README warns install.py uses the experimental comfy-env package and pixi. Configuration: model weights download on first use; no API keys. YAML configs under nodes/unirig/configs/model/ and nodes/unirig/configs/skeleton/ define model and skeleton specs. Running: load one of the six JSON workflows from workflows/ in ComfyUI and run the graph.

Real-World Use

A character artist receives a static mesh, drops it into the UniRigAutoRig node, gets a skinned character, then applies a Mixamo animation from assets/animation_templates/mixamo/ via UniRigApplyAnimation. The result exports through export_rigged_fbx with bundled Blender.

Code Health & Issues

Static analysis found 32 findings (11 high, 21 medium). The dominant issue is deep nesting (20 occurrences, max depth 8) in nodes/load_model.py, nodes/skeleton_extraction.py, and nodes/skinning.py. Duplicated code blocks appear 51 times across 16 files, notably nodes/animation.py and nodes/mia_auto_rig.py. Six files exceed reasonable size, led by nodes/mia/utils.py at 935 lines. Three files open files without context managers. nodes/unirig/direct_export_fbx.py catches broad exceptions.

SDLC gaps: CI exists but no workflow invokes the 4 test files. GitHub Actions are pinned to mutable tags (@v0.2.20), not commit SHAs. No lockfile, no Dependabot, no dependency scan. Two blobs exceed 5MB (realistic_male_character.glb at 19.7MB).

The Bottom Line

A functional wrapper for serious research code, with good workflow coverage and bundled Blender. The code quality issues are real but concentrated in utility files you likely won't touch. Use it if you need UniRig inside ComfyUI; harden CI before relying on it for production.

What the analyser found

Deployment readiness

5/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

89 files

Python46
YAML10
JSON7
TOML4
Markdown1

Transformers

Module dependencies

The 10 most depended-upon modules of 46, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_nodes_base["base"] n1_nodes_unirig___init__["__init__"] n2_nodes_unirig_tokenizer_spec["tokenizer_spec"] n3_nodes_mia_dataset_mixamo["dataset_mixamo"] n4_nodes_unirig_configs["configs"] n5_nodes_unirig_model_spec["model_spec"] n6_nodes_load_model["load_model"] n7_nodes_mia___init__["__init__"] n8_nodes_skeleton_extraction["skeleton_extraction"] n9_nodes_skinning["skinning"] n6_nodes_load_model --> n0_nodes_base n6_nodes_load_model --> n4_nodes_unirig_configs n7_nodes_mia___init__ --> n3_nodes_mia_dataset_mixamo n8_nodes_skeleton_extraction --> n0_nodes_base n8_nodes_skeleton_extraction --> n1_nodes_unirig___init__ n9_nodes_skinning --> n0_nodes_base n9_nodes_skinning --> n1_nodes_unirig___init__

Findings

LowDependencies declared without a lockfile - non-reproducible builds pyproject.toml

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high3

medium4

low1

Pin third-party GitHub Actions to a commit SHAhigh3 occurrences

.github/workflows

PozzettiAndrea/comfy-test/.github/workflows/pr-gate.yml@v0.2.20, Comfy-Org/publish-node-action@v1, PozzettiAndrea/comfy-test/.github/workflows/test-matrix.yml@v0.2.39

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Commit a lockfile beside the manifesthigh

pyproject.toml

manifest with no lockfile in scope

An unlocked range means the artifact you tested and the artifact you ship can contain different transitive code, so a malicious patch release reaches production with no diff.

Fix: Run the package manager once and commit the generated lockfile.

Make CI invoke the test suite it hashigh4 occurrences

.github/workflows

4 test files, no test command in any workflow

A green check that never executed an assertion is worse than no check, because reviewers trust it.

Fix: Add a test step to the existing workflow rather than a new workflow.

Declare least-privilege permissions for GITHUB_TOKENmedium2 occurrences

.github/workflows/pr-gate.yml

2 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

2 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium2 occurrences

assets/realistic_male_character.glb

2 blobs over 5MB: realistic_male_character.glb 19.7MB, bird.glb 7.7MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set timeout-minutes on the workflow jobslow3 occurrences

.github/workflows/pr-gate.yml

3 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.