The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries and their corresponding SHA256 checksums from the official nodejs.org distribution site or a well-known mirror (npmmirror.com). It implements integrity verification using sha256sum before extraction.
[COMMAND_EXECUTION]: Performs several shell operations including extracting compressed archives with tar, managing packages with npm, and executing the vendor-provided qhkit binary to perform image generation tasks.
[PERSISTENCE]: Recommends modifying the user's shell configuration file (~/.bashrc) to ensure the newly installed Node.js and qhkit binaries remain in the PATH across different terminal sessions.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: Accepts untrusted user input through the customCopy field (marketing copy) and uploadedImages (file paths) in the SKILL.md usage recipes.
Boundary markers: Commands use single-quoted JSON strings to encapsulate user-provided data.
Capability inventory: The skill has the ability to execute CLI commands and interact with the local file system and network via the qhkit tool.
Sanitization: The skill instructions explicitly recommend using a JSON file (@params.json) to pass arguments to the CLI, which is a defensive practice against shell injection vulnerabilities.

linkpix-main-image-set