The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the user on how to download the Node.js binary and its corresponding SHA256 checksum file from the official nodejs.org domain or a well-known mirror. It includes an integrity verification step using sha256sum before extracting the binary, which is a security best practice. While automated scans flagged the use of curl in a pipe, the operation is used for checksum validation rather than direct command execution.
Evidence: curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c -
[PERSISTENCE]: The documentation describes how to modify the user's shell profile (~/.bashrc) to include the newly installed Node.js binary in the system PATH. This is a common environment configuration step for local software installation to ensure availability across shell sessions.
Evidence: Instructions to append the PATH export command to the user's ~/.bashrc file.
[DYNAMIC_EXECUTION]: The skill provides pre-formatted command snippets for local image processing. These include a Python one-liner utilizing the Pillow library and a Node.js npx command for the sharp-cli utility, used to compress large images before they are processed by the tool.
Evidence: python -c "from PIL import Image, ImageOps; ..." and npx --yes sharp-cli ...
[COMMAND_EXECUTION]: The skill's primary functionality involves executing the qhkit command-line utility, which is the official tool for interacting with the vendor's video generation service. It handles task generation, status polling, and configuration.
Evidence: Extensive use of qhkit video generate, qhkit video status, and qhkit config commands.

linkpix-happyhorse-sales