The Agent Skills Directory

[PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes external media files (images, audio, video) via URLs. These assets are untrusted and could contain adversarial content designed to influence the video generation or steer the agent's behavior. The skill explicitly documents this risk and provides mitigation guidelines, such as only ingesting user-provided URLs and being skeptical of generation that diverges from the prompt.
Ingestion points: image_url and audio_url fields in the runcomfy run input JSON.
Boundary markers: The prompt is encapsulated within a JSON string passed to the CLI flag --input.
Capability inventory: Execution of the runcomfy CLI via the Bash tool.
Sanitization: No automated sanitization is performed on the content of the remote assets.
[EXTERNAL_DOWNLOADS]: The skill requires the @runcomfy/cli package from the NPM registry to function. This is a standard dependency for the skill's primary purpose. The instructions also promote secure installation practices by recommending the use of verified package managers rather than piping remote scripts into a shell.

ai-video-generation