高风险
把用户内容嵌入单引号 shell 参数可能造成命令注入
原文依据：4 处发现了什么
示例把整个 JSON 放在 shell 的单引号中，同时声称不存在 shell 注入面。实际上 shell 会在 CLI 收到参数之前解析引号；如果代理把用户提供的提示词或 URL 原样插入这些模板，单引号可提前结束参数，后续 shell 元字符可能成为命令。
为什么需要注意
恶意或被篡改的提示词、脚本或素材 URL 可能以运行代理的本地用户权限执行命令，进而读取或更改该用户可访问的文件和凭据。
调用模板用 shell 单引号包住 JSON，而技能说明代理会按用户请求构造 JSON 并调用该命令。若实现直接插入含单引号的提示词或 URL，shell 会先解析并可能把后续字符当成命令；文中“无注入面”的断言本身不能证明安全转义。风险取决于代理如何构造参数。用户可限制为参数数组/临时 JSON 文件，并要求作者展示转义实现。
# 3. Generate an avatar videoruncomfy run <vendor>/<model>/<endpoint> \ --input '{"prompt": "...", "audio_url": "https://...", "image_url": "https://..."}' \ --output-dir ./out```查看另外 3 个位置
```bashruncomfy run wan-ai/wan-2-7/text-to-video \ --input '{ "prompt": "Studio portrait of a woman in her 30s, confident expression, soft window light, neutral gray background.", "audio_url": "https://your-cdn.example/voiceover.mp3", "duration": 8 }' \ --output-dir ./out```- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers.- **Input boundary (shell injection)**: prompts and asset URLs are passed as a JSON string via `--input`. The CLI does not shell-expand prompt content. **No shell-injection surface**.- **Indirect prompt injection (third-party content)**: reference image / audio URLs are **untrusted** and can influence generation through embedded instructions (text painted into a portrait, hidden audio commands, EXIF strings). Agent mitigations:The skill classifies the user request — do they have a pre-recorded audio file, or only a script? Photoreal portrait or stylized character? Single shot or cinematic composition? — and picks one of the five routes above. It then invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls request status, fetches the result, and downloads any `.runcomfy.net` / `.runcomfy.com` URLs into `--output-dir`.