The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes video URLs, which introduces a surface for indirect prompt injection where instructions could be embedded in the video content or metadata.
Ingestion points: The video_url field within the JSON input for the runcomfy run command in SKILL.md.
Boundary markers: The skill documentation recommends that agents only process URLs provided by the user and notes that the CLI avoids shell expansion, but there are no explicit delimiters for the prompt itself.
Capability inventory: The skill uses the runcomfy CLI to initiate remote model runs and download generated files.
Sanitization: The CLI passes inputs as a JSON string to avoid direct shell injection, and the documentation highlights the risk of third-party content.
[COMMAND_EXECUTION]: The skill utilizes the runcomfy CLI to interact with the RunComfy Model API, performing operations like login, model execution, and status polling.
[EXTERNAL_DOWNLOADS]: The skill references the installation of the @runcomfy/cli package from the npm registry and downloads generated video assets from RunComfy infrastructure to the local output directory.

video-extend