The Agent Skills Directory

[PERSISTENCE]: The skill instructions direct the agent to modify the user's shell configuration file (~/.bashrc) by appending environment variable exports to ensure the manually installed Node.js binary remains in the system path across future sessions.- [PRIVILEGE_ESCALATION]: The skill recommends performing a global npm installation (npm i -g), an operation that typically necessitates administrative (root) access. The instructions explicitly reference the possibility of attempting to escalate privileges to complete this task.- [COMMAND_EXECUTION]: Core functionality depends on executing shell commands to download, verify, and install software runtimes. It also uses the qhkit command-line tool to perform image generation tasks based on user input.- [EXTERNAL_DOWNLOADS]: The skill fetches the Node.js runtime and associated checksums from nodejs.org, a well-known service, and utilizes npmmirror.com as a fallback mirror. It also installs the @iqinghu/qhkit package from the official npm registry. These downloads include integrity verification using sha256sum.- [INDIRECT_PROMPT_INJECTION]: The skill accepts and processes untrusted data in the form of user-provided images and descriptive prompts. These inputs are interpolated into tool parameters, creating a potential attack surface if the processed data contains malicious instructions targeting the image generation logic.
Ingestion points: Processed images (uploadedImages) and text prompts (prompt) used in qhkit image generate calls.
Boundary markers: Absent; the skill relies on standard JSON formatting without specific instructions for the agent to ignore or delimit embedded commands in user input.
Capability inventory: Includes shell command execution, binary installation, file system modification, and network-based image generation.
Sanitization: No explicit sanitization, filtering, or validation steps are defined for the inputs before they are passed to the CLI tool.

linkpix-model-pose-set