The Agent Skills Directory

[COMMAND_EXECUTION]: The cli.js wrapper utility uses spawnSync to launch the connector's internal entry point (cli.ts or dist/cli.js). This is a platform-standard mechanism for ensuring compatibility across different Node.js environments and does not execute arbitrary user-supplied input.
[EXTERNAL_DOWNLOADS]: The skill interacts with the official Runway API at api.dev.runwayml.com. It also references documentation and authentication tools from zapier.com. These are legitimate external resources necessary for the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external media assets via HTTPS URLs or data URIs to perform generative tasks (e.g., upscaling or restyling). While this constitutes an untrusted data ingestion surface, the skill implements strict Zod input validation and lacks exploitable capabilities like local file system modifications or arbitrary network routing that could be abused via indirect injection.

runway