The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the runcomfy CLI tool via the Bash tool to perform music generation, inpainting, and outpainting operations.- [EXTERNAL_DOWNLOADS]: Recommends the installation of the @runcomfy/cli package from the NPM registry and the skill itself from the agentspace-so/runcomfy-agent-skills repository.- [DATA_EXFILTRATION]: Communicates with external domains runcomfy.com and runcomfy.net to perform API calls for music generation and to download output files. These domains are not on the standard whitelisted domains list.- [PROMPT_INJECTION]: The skill processes untrusted third-party audio URLs, which represents an indirect prompt injection attack surface.
Ingestion points: The audio URL parameter used in the audio-inpaint and audio-outpaint routes within SKILL.md.
Boundary markers: The CLI uses structured JSON input via the --input flag to maintain command boundaries.
Capability inventory: The skill utilizes the runcomfy CLI tool through Bash for network communication and file system writes.
Sanitization: Documentation states that the CLI transmits JSON directly to the API without shell expansion; however, the model remains susceptible to instructions embedded within the audio data itself.

ace-step