The Agent Skills Directory

[SAFE]: The skill provides instructions for interacting with the RunComfy API. It includes standard security practices such as using restricted file permissions (0600) for local token storage and providing an environment variable alternative (RUNCOMFY_TOKEN) for CI/CD environments.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the @runcomfy/cli Node.js package. This is the official tool for the service being integrated and is a standard requirement for this type of skill.
[INDIRECT_PROMPT_INJECTION]: The skill accepts an audio_url as input, which represents a standard ingestion point for external data. The documentation explicitly addresses injection risks by stating that user prompts are passed as JSON strings and that the CLI does not perform shell expansion, mitigating common command injection vectors.
[DATA_EXFILTRATION]: Network operations are restricted to the vendor's official domains (model-api.runcomfy.net and *.runcomfy.com) for submitting generation requests and downloading resulting video files. The CLI includes a 2 GiB download cap to prevent resource exhaustion attacks.

wan-2-7