The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the runcomfy CLI to interact with the ElevenLabs music generation API. All commands are structured and documented, using the runcomfy run elevenlabs/elevenlabs/music-generation pattern.
[EXTERNAL_DOWNLOADS]: The skill references the official RunComfy CLI (@runcomfy/cli) and the RunComfy Model API. These are well-known services provided by the vendor 'doany-ai' (RunComfy), and the URL patterns match verified official domains (runcomfy.com, runcomfy.net).
[CREDENTIALS_UNSAFE]: The documentation correctly follows security best practices for secret management. It instructs users to use runcomfy login (storing tokens in a restricted config file) or the RUNCOMFY_TOKEN environment variable. There are no hardcoded secrets or instructions to expose credentials.
[REMOTE_CODE_EXECUTION]: The skill explicitly warns against insecure installation patterns (e.g., pipe-to-shell) and recommends using a verified package manager (npm or npx). The actual skill execution involves calling a local binary with JSON inputs, which does not trigger shell expansion.
[INDIRECT_PROMPT_INJECTION]: While the skill ingests user-provided text for music prompts and lyrics, it treats these as data passed to a structured JSON field. This content is sent over HTTPS to the model API and does not influence the agent's logic or the local machine's command execution environment.

elevenlabs-music-generation