The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of image URLs, which could contain instructions intended to influence the model's behavior.
Ingestion points: The images field in SKILL.md accepts an array of publicly-fetchable HTTPS URLs.
Boundary markers: The skill uses a structured JSON body to separate instruction prompts from the input image data.
Capability inventory: The skill utilizes the runcomfy CLI to perform network requests to the model API and write output images to the local filesystem via the --output-dir parameter.
Sanitization: Documentation indicates that the CLI does not perform shell expansion on the user-supplied prompt, mitigating certain injection risks at the interface level.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the @runcomfy/cli Node.js package and retrieves generated image results from official vendor domains including *.runcomfy.net and *.runcomfy.com.
[COMMAND_EXECUTION]: The skill instructs the agent to execute the runcomfy command-line tool to perform image editing tasks through the RunComfy Model API.

gpt-image-edit