The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches Node.js binaries and verification checksums from official Node.js domains and the qhkit tool from the npm registry or official mirrors. These are well-known services used for environment configuration.
[COMMAND_EXECUTION]: The skill relies on shell commands to interact with the qhkit CLI, managing image generation tasks and configuration settings via JSON payloads.
[PERSISTENCE]: Instructions in the environment setup section suggest modifying the user's shell profile (~/.bashrc) to persistently add Node.js to the system PATH.
[PRIVILEGE_ESCALATION]: The skill mentions escalating privileges to perform global installation of npm packages if standard installation methods fail.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted user data (images and text prompts) which are then passed as arguments to the qhkit command-line tool. There are no explicit boundary markers or sanitization steps mentioned to handle potentially malicious embedded instructions in the input data.

linkpix-ecom-image