The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation instructs the user to install the @runcomfy/cli Node.js package globally. This package is an official tool provided by the vendor for interacting with their service API.
[COMMAND_EXECUTION]: The skill functions by invoking the runcomfy CLI tool locally to perform image editing tasks. The documentation highlights that input is passed as a JSON string to the CLI to mitigate shell injection risks from the prompt content.
[INDIRECT_PROMPT_INJECTION]: The skill accepts user prompts and external image URLs as input, which are processed by a remote generative model. This creates a surface for potential indirect prompt injection attacks.
Ingestion points: The skill processes a prompt string and a list of images URLs as defined in the schema within SKILL.md.
Boundary markers: The skill uses JSON formatting for input transmission to the CLI, which is intended to isolate the prompt text from the local shell environment.
Capability inventory: The skill has the capability to write files to a local directory specified by the user and perform network operations to the vendor's API endpoints at runcomfy.net and runcomfy.com.
Sanitization: The skill relies on structured JSON transmission and vendor-side API validation, and it includes a dedicated security section warning users about model-level image-based injection risks.

gpt-image-edit