The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute the runcomfy command-line tool to perform video generation tasks. The commands include specific subcommands like runcomfy run kling/kling-3.0/<tier>/<mode> with JSON-formatted inputs and output directory specifications.
[EXTERNAL_DOWNLOADS]: The documentation specifies the installation of a global Node.js package, @runcomfy/cli, which is the official tool provided by the vendor (runcomfy-com) to interact with their services.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes user-provided text prompts and external image URLs.
Ingestion points: Untrusted data enters the context through the prompt, image_url, and tail_image_url fields defined in the input schema within SKILL.md.
Boundary markers: The skill uses JSON encapsulation for parameters passed via the --input flag, which helps delimit data from the command structure.
Capability inventory: The skill utilizes the runcomfy CLI to perform network requests to the vendor API and writes generated video files to a user-defined directory on the local file system.
Sanitization: The skill explicitly mentions that the CLI does not use shell expansion when processing the JSON input, mitigating the risk of shell injection during prompt interpolation.

kling-3-0