The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download Node.js from the official nodejs.org distribution server and install the @iqinghu/qhkit package from the npm registry. These are well-known and vendor-affiliated sources.
[COMMAND_EXECUTION]: The skill uses the qhkit CLI tool to perform its primary video analysis and generation tasks. It also uses system utilities like tar for extraction and sha256sum for binary integrity verification during the setup process.
[DYNAMIC_EXECUTION]: The skill provides a fallback mechanism for image processing using local Python (Pillow) or Node.js (sharp-cli) execution. These commands use fixed code templates to resize images that exceed size limits and do not execute untrusted logic.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes content from external video platforms.
Ingestion points: Untrusted video links are provided via the resourceUrl parameter to the video-inspire command.
Boundary markers: The skill instructions explicitly direct the agent to rewrite the generated scripts and present them for user confirmation, serving as a manual security boundary.
Capability inventory: The skill has capabilities for CLI command execution, local file system access (for images), and network communication through the vendor's tool.
Sanitization: Content is sanitized through the agent's interpretation and the mandatory user-review step.

linkpix-happyhorse-clone