The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process external, untrusted media files which creates a surface for indirect prompt injection.
Ingestion points: The image_url, video_url, and audio_url fields in SKILL.md accept arbitrary remote URLs.
Boundary markers: The instructions do not define specific delimiting boundaries or "ignore instructions" wrappers for the content fetched from these URLs.
Capability inventory: The skill utilizes the runcomfy CLI to perform network operations (API calls to *.runcomfy.net) and file system writes (via the --output-dir flag).
Sanitization: The skill explicitly acknowledges the risk of image-based prompt injection in the 'Security & Privacy' section, though it does not provide automated sanitization for these external inputs.
[COMMAND_EXECUTION]: The skill facilitates the execution of the @runcomfy/cli tool. While this is the intended primary purpose of the skill for the vendor's platform, it involves passing user-provided strings (prompts) and file paths to a local command-line interface.

image-to-video