The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes media files from external URLs, creating a vulnerability surface where adversarial content in the source media could potentially influence the agent's behavior.
Ingestion points: The video_url and audio_url fields in the JSON input for the runcomfy run command located in SKILL.md.
Boundary markers: The instructions specify that data is passed via JSON strings, and the security section notes that the CLI does not shell-expand this content.
Capability inventory: The skill can execute the runcomfy command using the Bash tool, as constrained by the frontmatter.
Sanitization: The documentation advises agents to only use URLs provided by the user and provides guidance on monitoring for divergent outputs that might indicate malicious reference assets.
[EXTERNAL_DOWNLOADS]: The skill references the installation and use of the @runcomfy/cli package via the NPM registry, which is the official tool for the service.
[COMMAND_EXECUTION]: The skill instructions involve executing the runcomfy command-line utility to perform lip-syncing and video generation tasks.

lipsync