The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches Node.js binaries and integrity verification files (SHASUMS256.txt) from the official Node.js distribution domain (nodejs.org).
[EXTERNAL_DOWNLOADS]: It installs the '@iqinghu/qhkit' package from the npm registry, allowing for an alternative mirror (registry.npmmirror.com) to ensure connectivity.
[COMMAND_EXECUTION]: The skill utilizes shell commands to manage dependencies (npm), extract archives (tar), and verify download integrity (sha256sum). These are standard administrative tasks for CLI setup.
[PERSISTENCE]: Instructions suggest appending path configurations to the user's ~/.bashrc file. While this maintains the availability of the Node.js environment across sessions, it is a routine practice for manual software installations.
[INDIRECT_PROMPT_INJECTION]: The skill includes an attack surface by ingesting external user data (images and selling point text) into the generative process.
Ingestion points: User-provided images and the customCopy field in SKILL.md.
Boundary markers: The skill instructs the agent to use candidate values from tool outputs verbatim to ensure consistency.
Capability inventory: Execution of the qhkit binary for image processing.
Sanitization: Relies on tool-defined schemas and explicit instructions for the agent to stick to returned labels.

linkpix-detail-page