The Agent Skills Directory

[SAFE]: The skill utilizes the official RunComfy CLI (@runcomfy/cli) to interact with the RunComfy Model API. All network operations and package dependencies are associated with the vendor's established infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of reference images, videos, and audio clips via external URLs. This represents a standard attack surface for multi-modal generation tools. However, the skill incorporates explicit security instructions (found in the 'Security & Privacy' section) directing the agent to ignore any instructions or directives embedded within the media content.
Ingestion points: SKILL.md defines input fields for reference_images, reference_videos, and reference_audios which accept arbitrary URLs.
Boundary markers: Input parameters are structured within a JSON string passed via the --input flag, providing a clear boundary between the prompt and the data.
Capability inventory: The skill uses the Bash(runcomfy *) tool to execute model runs and download generated content.
Sanitization: The skill provides natural language instructions to the agent to treat reference media as untrusted data and disregard any embedded commands.
[CREDENTIALS_UNSAFE]: The skill demonstrates safe credential handling by supporting environment variables (RUNCOMFY_TOKEN) and storing local tokens in a restricted configuration file (~/.config/runcomfy/token.json) with 0600 permissions.

wan-3-0-prime-reference-to-video