The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the allowed-tools frontmatter field to strictly limit the agent's shell access to the runcomfy command only, preventing the execution of arbitrary or malicious system commands.
[EXTERNAL_DOWNLOADS]: The skill references the installation of the @runcomfy/cli package. This is the official command-line interface for the service described and is provided by the vendor, making it a legitimate and expected dependency.
[CREDENTIALS_SAFE]: The documentation includes best practices for API token management, such as using environment variables (RUNCOMFY_TOKEN) or local configuration files with restricted file permissions (mode 0600) to prevent unauthorized access.
[INDIRECT_PROMPT_INJECTION]: The skill explicitly acknowledges the risk of processing untrusted content from external URLs (images and audio) and provides specific mitigation strategies for the agent to ensure input boundaries are respected.

ai-avatar-video