The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the @runcomfy/cli package from the npm registry and is itself installed from a remote repository.
Evidence: npm i -g @runcomfy/cli and npx skills add agentspace-so/runcomfy-skills in SKILL.md.
[COMMAND_EXECUTION]: The skill operates by executing the runcomfy command-line interface to interact with the RunComfy Model API.
Evidence: Examples showing runcomfy run bytedance/seedance-v2/pro in SKILL.md.
[CREDENTIALS_UNSAFE]: The skill manages authentication through an API token stored at ~/.config/runcomfy/token.json or provided via the RUNCOMFY_TOKEN environment variable.
Evidence: Mention of token storage and environment variable usage in the 'Security & Privacy' section of SKILL.md.
[PROMPT_INJECTION]: The skill ingests untrusted data via image_url, video_url, and audio_url parameters, which creates an attack surface for indirect prompt injection at the model level.
Ingestion points: image_url, video_url, and audio_url fields in the endpoint schema in SKILL.md.
Boundary markers: None specified for the content of external files.
Capability inventory: Shell command execution via runcomfy run in SKILL.md.
Sanitization: The skill notes that inputs are handled as JSON strings to prevent local shell injection, but notes that image-based prompt injection remains a risk.

seedance-v2