The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides detailed instructions for executing the runcomfy CLI to run model-based image editing tasks.
[EXTERNAL_DOWNLOADS]: The documentation includes instructions to install the @runcomfy/cli package from NPM and references the agentspace-so/runcomfy-skills repository on GitHub. These resources are consistent with the identified vendor infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes user-supplied prompts and external image URLs.
Ingestion points: Processed data includes declarative prompt strings and publicly fetchable HTTPS image URLs (SKILL.md).
Boundary markers: Inputs are encapsulated in a JSON object passed to the CLI; the documentation explicitly states the CLI does not perform shell expansion on the prompt.
Capability inventory: The CLI performs authenticated network requests to model-api.runcomfy.net and writes generated files to a local directory specified by the user.
Sanitization: The CLI implements a 2 GiB size cap on downloads to prevent disk-exhaustion attacks and uses restricted file permissions (0600) for credential storage.

flux-kontext