The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the @runcomfy/cli package via NPM and adding the skill using npx. These are standard installation steps for the tools required to interact with the RunComfy service.
[COMMAND_EXECUTION]: The skill documents the use of the runcomfy command-line interface to execute model runs. It includes examples of passing user prompts and configuration parameters via shell commands.
[INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface by ingesting user-provided natural language prompts for image generation.
Ingestion points: User prompts are interpolated into the --input JSON argument in SKILL.md examples.
Boundary markers: The prompts are encapsulated within a JSON body.
Capability inventory: The skill uses runcomfy CLI for network-based model execution.
Sanitization: Documentation explicitly notes that the CLI transmits the JSON body directly to the API without shell expansion, mitigating local command injection risks.
[DATA_EXFILTRATION]: The skill communicates with model-api.runcomfy.net to send prompts and downloads results from *.runcomfy.net and *.runcomfy.com. This network activity is consistent with the primary functionality of a cloud-hosted image generation service.

flux-2-klein