The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute the runcomfy CLI tool. It provides command templates like runcomfy run happyhorse/happyhorse-1-0/text-to-video which involve shell execution with interpolated user input for the prompt and output directory.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the @runcomfy/cli package from the NPM registry and downloads generated video assets from domains ending in *.runcomfy.net or *.runcomfy.com. It also references a GitHub repository agentspace-so/runcomfy-skills for adding the skill via npx.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input by passing it to an external video generation model. While this creates a potential surface for prompt injection against the remote model, the skill includes security controls to mitigate local risks.
Ingestion points: The prompt field in the CLI command template in SKILL.md accepts arbitrary user text.
Boundary markers: The documentation specifies that the CLI passes input as a JSON string to avoid shell expansion vulnerabilities.
Capability inventory: The skill can execute the runcomfy CLI and download files to a local --output-dir.
Sanitization: The CLI implementation is noted to transmit the JSON body directly to the API over HTTPS to prevent shell injection.

happyhorse-1-0