The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the Node.js runtime from its official distribution server (nodejs.org) or a reputable mirror (npmmirror.com). It also installs the @iqinghu/qhkit package from the NPM registry. All sources are well-known and official.
[COMMAND_EXECUTION]: The skill uses the qhkit command-line utility to perform image generation and configuration. It employs standard shell commands such as curl, tar, and sha256sum to manage dependencies. The automated scan's identification of remote code execution refers to a checksum verification step using sha256sum to ensure the integrity of the downloaded Node.js binary before extraction.
[PERSISTENCE]: The skill includes instructions to update the system PATH by appending the Node.js binary location to the user's ~/.bashrc file. This ensures the runtime remains available across shell sessions, which is standard procedure for local environment setup in restricted environments.
[INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided text descriptions to generate clothing swap prompts via the qhkit image generate command. While this constitutes an external data ingestion surface, the skill provides specific formatting templates to guide the AI's generation process and maintain structure.
Ingestion points: User descriptions and local image paths used in prompt generation in SKILL.md examples.
Boundary markers: Use of 【】 markers as delimiters for dynamic content placeholders in the prompt templates.
Capability inventory: Execution of qhkit CLI which performs network requests for AI processing.
Sanitization: No explicit validation or sanitization logic is defined for the user-supplied prompt strings.

linkpix-model-outfit-swap