The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection by processing user-provided text prompts for image generation via the /jobs endpoint. However, it incorporates robust mitigation strategies.
Ingestion points: The prompt and negative_prompt fields within the POST /jobs API endpoint.
Boundary markers: The skill documentation specifies the use of Zod schemas for strict input validation.
Capability inventory: The system is designed to interact with the ComfyUI API and store generated artifacts in local or S3-compatible storage.
Sanitization: Inputs are validated against defined schemas, and a 'Privacy Mode' is implemented to redact sensitive prompts from logs and databases.
[COMMAND_EXECUTION]: The documentation includes standard setup and administration commands such as npm install and npx tsx. It also provides troubleshooting guidance for system firewall configuration (ufw, iptables) and network diagnostics (curl, ss, netstat). These commands are intended for manual execution by a system administrator and do not represent unauthorized command execution by the agent.
[DATA_EXFILTRATION]: The gateway manages sensitive configuration parameters, including API keys, JWT secrets, and S3 credentials, exclusively through environment variables. This approach aligns with industry-standard practices for secure configuration management and prevents hardcoded credential exposure.

comfyui-gateway