The Agent Skills Directory

[PERSISTENCE]: The skill instructions include modifying the user's shell configuration file (~/.bashrc) to persistently add a new Node.js binary path to the system environment.
[EXTERNAL_DOWNLOADS]: The skill fetches Node.js binaries and checksum verification files from nodejs.org and npmmirror.com (a well-known Alibaba-maintained mirror). These are well-known technology services and the process includes proper SHA256 checksum verification.
[COMMAND_EXECUTION]: The skill utilizes several system commands for setup and operation, including npm, curl, tar, and sha256sum, as well as the vendor's proprietary CLI tool qhkit for generative tasks.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its processing of untrusted data.
Ingestion points: User-provided product descriptions and uploaded reference images are interpolated into the qhkit command arguments in SKILL.md.
Boundary markers: None identified; the skill relies on natural language instructions within the prompt to separate user content from structural layout analysis.
Capability inventory: The skill has the capability to execute the qhkit command and perform network operations via the CLI tool to generate images.
Sanitization: No explicit sanitization or escaping is performed on the user-provided text before it is passed to the generation command.

linkpix-detail-page-clone