Single-quoted command examples conflict with the assurance that quotes cannot cause injection
Source references: 4The examples place the entire JSON value inside shell single quotes. If an agent directly inserts user lyrics there, an apostrophe is interpreted by the shell before the CLI receives anything; the CLI's claimed lack of expansion cannot protect that layer. Nevertheless, the document says even quotes and `$(...)` create no injection surface.
Crafted or accidental lyric text could terminate the argument and execute additional local shell commands, exposing or changing data available to the user.
The examples wrap JSON in shell single quotes while the skill is intended to carry user-provided prompts and lyrics. If an agent directly interpolates text containing `'` into this template, the quote terminates before the CLI receives the JSON and following text may be interpreted by the shell. The absolute assurance describes CLI handling after parsing and does not establish that this shell construction is safe. Users can require argument arrays, a JSON file, or robust JSON/shell escaping.
```bashruncomfy run elevenlabs/elevenlabs/music-generation \ --input '{ "prompt": "Upbeat indie-pop anthem, bright electric guitars, driving drums, 120 BPM, female lead vocal. [Intro 8 bars] instrumental build. [Verse] Chalk on the palms, laces double-knotted, morning on the ridge. [Chorus] We rise, we strike, we never fade out. [Bridge] soft breakdown, just piano and voice. [Outro] full band, fade.", "music_length_ms": 60000 }' \ --output-dir ./out```Show 3 other places
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers. Never echo the token into a prompt, log it, or check it in.- **Input boundary (shell injection)**: the prompt is passed as a JSON string via `--input`. The CLI does not shell-expand prompt content; it transmits the JSON body directly to the Model API over HTTPS. **No shell-injection surface from prompt content**, even with backticks, quotes, or `$(...)` patterns.- **Lyrics provenance**: if the user supplies lyrics, confirm they have the rights to them. Generating music around copyrighted lyrics is the operator's responsibility — the skill does not check.```bashruncomfy run elevenlabs/elevenlabs/music-generation \ --input '{ "prompt": "Upbeat indie-pop anthem, bright electric guitars, driving drums, 120 BPM, female lead vocal. [Intro 8 bars] instrumental build. [Verse] Chalk on the palms, laces double-knotted, morning on the ridge. [Chorus] We rise, we strike, we never fade out. [Bridge] soft breakdown, just piano and voice. [Outro] full band, fade.", "music_length_ms": 60000 }' \ --output-dir ./out```ElevenLabs Music reads **one `prompt` field** that carries both the style brief and the lyrics. Structure it well: