The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries and the @iqinghu/qhkit package from official and well-known sources (nodejs.org, npmjs.com, and npmmirror.com). These downloads are performed during the environment self-bootstrapping phase.
[COMMAND_EXECUTION]: The skill executes multiple shell commands to install dependencies, verify file integrity using sha256sum, and manage the generation of image and video assets. The piped commands identified in automated scans are used for verifying file hashes rather than direct script execution.
[PERSISTENCE]: The instructions recommend appending export PATH commands to the user's ~/.bashrc file. This is intended to ensure the locally installed Node.js binary remains accessible across different shell sessions.
[INDIRECT_PROMPT_INJECTION]: The skill utilizes the qhkit video-to-text and qhkit video-inspire commands to process external video content from URLs (e.g., Douyin/Kuaishou). This represents an attack surface where instructions embedded in external media metadata or transcriptions could influence the agent's downstream behavior.
Ingestion points: External video URLs processed via qhkit video-inspire and qhkit video-to-text in SKILL.md.
Boundary markers: Not explicitly defined; the skill relies on the CLI's JSON output for processing.
Capability inventory: The skill can execute shell commands, read local image files, and perform network operations via the qhkit tool.
Sanitization: No specific sanitization or filtering of the content extracted from external videos is described.

linkpix-image-ad-assets