The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the runcomfy CLI to interact with remote image and video generation models. It explicitly limits its execution environment to Bash(runcomfy *), following the principle of least privilege by scoping tool access to a specific utility.
[EXTERNAL_DOWNLOADS]: The skill instructs the installation of the @runcomfy/cli package via standard package registries (npm/npx). As RunComfy is the vendor of this skill, these references to their own official CLI are considered safe and standard functionality.
[INDIRECT_PROMPT_INJECTION]: The skill acknowledges that external asset URLs (reference videos, character images, control images) are untrusted data sources. It provides explicit guidance for the agent to mitigate risks by only ingesting user-provided URLs and being aware of potential discrepancies between prompts and reference asset content.
[CREDENTIALS_SAFE]: The skill recommends using runcomfy login which stores tokens in a local configuration file with restricted permissions (~/.config/runcomfy/token.json mode 0600) or using environment variables, avoiding hardcoded secrets.

controlnet-pose