Embedding user content in single-quoted shell arguments can enable command injection
Source references: 4The examples place the entire JSON value inside shell single quotes while claiming there is no shell-injection surface. The shell parses quoting before the CLI receives the argument; if an agent inserts a user-supplied prompt or URL verbatim, a single quote can terminate the argument and subsequent shell metacharacters can become commands.
A malicious or altered prompt, script, or asset URL could execute commands with the local privileges of the agent, potentially reading or changing accessible files and credentials.
The invocation wraps JSON in shell single quotes, while the skill says the agent builds matching JSON from the request and invokes the command. If an implementation directly interpolates a prompt or URL containing a single quote, the shell parses it first and may treat following characters as commands; the stated “no shell-injection surface” does not demonstrate safe quoting. The risk depends on argument construction. Users can require argument-array or JSON-file input and ask the author to show the escaping implementation.
# 3. Generate an avatar videoruncomfy run <vendor>/<model>/<endpoint> \ --input '{"prompt": "...", "audio_url": "https://...", "image_url": "https://..."}' \ --output-dir ./out```Show 3 other places
```bashruncomfy run wan-ai/wan-2-7/text-to-video \ --input '{ "prompt": "Studio portrait of a woman in her 30s, confident expression, soft window light, neutral gray background.", "audio_url": "https://your-cdn.example/voiceover.mp3", "duration": 8 }' \ --output-dir ./out```- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers.- **Input boundary (shell injection)**: prompts and asset URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content. **No shell-injection surface**.- **Indirect prompt injection (third-party content)**: reference image / audio URLs are **untrusted** and can influence generation through embedded instructions (text painted into a portrait, hidden audio commands, EXIF strings). Agent mitigations:The skill classifies the user request — do they have a pre-recorded audio file, or only a script? Photoreal portrait or stylized character? Single shot or cinematic composition? — and picks one of the five routes above. It then invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls request status, fetches the result, and downloads any `.runcomfy.net` / `.runcomfy.com` URLs into `--output-dir`.