The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documents the installation of the @runcomfy/cli package from the npm registry. This is the official command-line interface for the RunComfy service.
[COMMAND_EXECUTION]: The skill makes extensive use of the runcomfy CLI through the Bash tool to interact with StepFun-AI's ACE Step models. This is consistent with the skill's stated purpose and is scoped within the allowed-tools configuration.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an interface for processing external data including audio URLs and text-based lyrics.
Ingestion points: Audio files are ingested via HTTPS URLs (audio field), and lyrics/tags are provided as strings in SKILL.md.
Boundary markers: The documentation notes that the CLI transmits inputs as a JSON body directly to the API, which mitigates shell injection risks.
Capability inventory: The skill uses the runcomfy CLI for network-based model invocation and file downloads to a local directory.
Sanitization: The CLI handles prompt content as data within a JSON payload rather than executable shell arguments.
[CREDENTIALS_UNSAFE]: The skill describes the default behavior of the runcomfy login command, which stores an API token at ~/.config/runcomfy/token.json. It correctly advises the use of environment variables for automated environments and warns against leaking the token in logs or prompts.

ace-step