The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted user prompts and external media URLs (images, video, audio) as inputs for AI video generation. This constitutes a surface for indirect prompt injection.\n
Ingestion points: The prompt, image_url, audio_url, and video_url parameters used in runcomfy run commands in SKILL.md accept untrusted data.\n
Boundary markers: Input data is structured within a JSON object passed to the --input argument, providing a structural boundary.\n
Capability inventory: The skill invokes the runcomfy CLI tool using the Bash tool as constrained in the frontmatter.\n
Sanitization: The 'Security & Privacy' section explicitly cautions users about the untrusted nature of external assets and states the CLI does not shell-expand prompt strings.\n- [COMMAND_EXECUTION]: The skill makes use of the Bash(runcomfy *) tool configuration, which restricts command execution to the specific runcomfy CLI, reducing the risk of arbitrary command injection.\n- [EXTERNAL_DOWNLOADS]: The documentation recommends the installation of the @runcomfy/cli package from the npm registry, which is the official tool provided by the skill's vendor.

ai-video-generation