The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries and verification files directly from the official nodejs.org website.
[EXTERNAL_DOWNLOADS]: It installs the @iqinghu/qhkit package from the npm registry, utilizing well-known mirrors like npmmirror.com (Alibaba Cloud) for reliable access in specific regions.
[COMMAND_EXECUTION]: The skill utilizes the qhkit command-line utility to perform its core image generation and management tasks.
[DYNAMIC_EXECUTION]: To handle files exceeding the 10MB limit, the skill provides specific Python and Node.js code snippets. These snippets use standard libraries (Pillow for Python and sharp-cli for Node.js) to resize and compress images locally before submission.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied image prompts and reference images. While this provides a surface for indirect instructions, the skill limits the risk by focusing on generating image outputs and using structured CLI parameters for task submission.
[SAFE]: The automated alert regarding remote code piped to shell was determined to be a false positive. The command curl ... | grep ... | sha256sum -c - uses the piped output for cryptographic integrity verification of the Node.js download, which is a security best practice, rather than executing the downloaded content as a script.

linkpix-nano-banana-2