The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to construct shell commands using user-provided inputs for music prompts and lyrics, which could lead to command injection if malicious characters are included.
Ingestion points: SKILL.md specifies interpolation of user data into the --prompt and --lyrics arguments of the uv run comfy-musicgen generate command.
Boundary markers: No explicit instructions or delimiters are provided to the agent to escape shell metacharacters or sanitize the input strings.
Capability inventory: The skill relies on uv run to execute CLI tools, granting the ability to run shell commands in the workspace environment.
Sanitization: There is no evidence of sanitization, validation, or filtering of the external content before it is placed in the command string.
[COMMAND_EXECUTION]: The skill utilizes several CLI tools to perform its tasks, including launching a local network service.
Evidence includes the execution of comfy-musicgen, comfy-media, comfy-model-downloader, and comfy-tools-setup via uv run.
The skill specifically starts a local media gallery using uv run comfy-media gallery bound to 127.0.0.1:8765.

comfy-musicgen