The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the runcomfy CLI tool to interact with Google Veo 3-1 models. The instructions explicitly scope these commands to the runcomfy binary and use JSON-encoded inputs to mitigate shell injection risks.
[EXTERNAL_DOWNLOADS]: The skill references the installation of the @runcomfy/cli package via NPM. This represents a standard installation procedure for the vendor's official command-line utility.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data in the form of video URLs, creating a surface for potential injection attacks.
Ingestion points: External video URLs are passed to the runcomfy run command within SKILL.md.
Boundary markers: The documentation specifies that inputs are passed as JSON strings to prevent shell-level injection. It also includes a security section advising the agent to be aware of potentially malicious content embedded in reference videos.
Capability inventory: The skill is restricted to running the runcomfy tool via Bash, which performs network operations to the vendor's API and file downloads to a local directory.
Sanitization: While the CLI avoids shell expansion for its arguments, the skill relies on the upstream model's internal safety filters to handle potentially malicious content within the video frames themselves.

video-extend