The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface where instructions could be embedded in the metadata of third-party video files provided via URL.
Ingestion points: The video_url parameter within the JSON input for the runcomfy run command in SKILL.md.
Boundary markers: Input is structured as a JSON string, separating configuration from execution.
Capability inventory: The restricted runcomfy CLI allows for remote model execution and file downloads to a local directory.
Sanitization: The documentation explicitly advises agents to only process URLs provided by the user and provides prompt engineering guidelines to maintain the integrity of the original content.
[COMMAND_EXECUTION]: The skill uses the Bash tool, which is strictly limited to the runcomfy command prefix via the allowed-tools frontmatter configuration.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the @runcomfy/cli package from the NPM registry. This package is the official tool provided by the vendor (runcomfy-com) and is used for its intended purpose.

video-outpainting