The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the @runcomfy/cli to execute video processing tasks. The instructions guide the agent to pick the appropriate model based on user intent and call the runcomfy run command with structured JSON input.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied natural language prompts and media URLs (video, image, reference_image).
Ingestion points: User input flows into the --input JSON object within the runcomfy CLI calls in SKILL.md.
Boundary markers: The 'Security & Privacy' section explicitly states that input is passed as a JSON string and not shell-expanded to mitigate shell injection.
Capability inventory: The skill performs command execution and file system writes via the --output-dir parameter.
Sanitization: The skill documents that the CLI transmits the JSON body over HTTPS, though it correctly identifies that third-party media content remains a vector for model-level injection.
[EXTERNAL_DOWNLOADS]: The skill relies on the official @runcomfy/cli Node.js package and downloads generated video content from the vendor's official domains (*.runcomfy.net, *.runcomfy.com).
[SAFE]: The documentation for API token management (~/.config/runcomfy/token.json) and the use of the RUNCOMFY_TOKEN environment variable follows standard CLI security practices for sensitive data handling.

video-edit