The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input and external data, creating a potential surface for indirect prompt injection.
Ingestion points: The skill accepts user-provided prompt, lyrics, and tags, and also fetches external audio files via user-supplied URLs for editing tasks (SKILL.md).
Boundary markers: Instructions are passed to the CLI as a structured JSON string via the --input flag, which helps separate data from the command execution flow.
Capability inventory: The skill utilizes the Bash tool to execute runcomfy run for remote music generation and editing.
Sanitization: The documentation states that the CLI transmits JSON directly to the API without shell expansion, providing a layer of protection against traditional injection.
[EXTERNAL_DOWNLOADS]: Fetches necessary tools and interacts with remote services for its primary function.
Evidence: Installs the @runcomfy/cli package via NPM and communicates with the runcomfy.net API for music processing tasks (SKILL.md).
[COMMAND_EXECUTION]: Executes shell commands to manage music generation workflows.
Evidence: Invokes runcomfy subcommands like run and login using the Bash tool to perform the skill's stated tasks (SKILL.md).

ai-music