The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the installation of the @runcomfy/cli package from the official NPM registry. This is a scoped package belonging to the skill's vendor infrastructure.
[COMMAND_EXECUTION]: The skill utilizes the runcomfy command-line tool to execute lip-sync operations via the Bash tool. It implements security best practices by passing parameters within a structured JSON string via the --input flag, which reduces the risk of shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied media URLs (video_url, audio_url). These external assets represent an untrusted ingestion point where adversarial content could theoretically influence the agent's behavior or the generative model's output.
Ingestion points: video_url and audio_url parameters in the runcomfy run command (SKILL.md).
Boundary markers: The skill documentation explicitly describes passing data within a JSON string to the CLI to prevent shell expansion and interpolation issues.
Capability inventory: Execution of authorized runcomfy CLI commands and file downloads to a local output directory.
Sanitization: The skill relies on the CLI's internal handling of JSON and instructs the agent to only ingest URLs explicitly provided by the user.

lipsync