The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches Node.js binaries and checksums from nodejs.org and official Alibaba mirrors (npmmirror.com).
Downloads the Node.js tarball: https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz.
Fetches checksums for integrity verification: https://nodejs.org/dist/v22.22.3/SHASUMS256.txt.
[COMMAND_EXECUTION]: Executes several shell commands to manage the environment and process media.
Uses npm i -g @iqinghu/qhkit to install the primary CLI tool from the vendor's repository.
Utilizes curl, grep, tar, and sha256sum to automate the installation and verification of Node.js if missing from the system.
Invokes qhkit CLI for image generation, task estimation, and configuration management.
[PERSISTENCE]: Modifies the user's shell configuration to persist path changes.
Instructs the agent to append the Node.js binary path to the shell profile: export PATH="..." >> ~/.bashrc.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions.
Ingestion points: Reads user-provided images (uploadedImages), prompts (prompt), and marketing copy (customCopy) in SKILL.md.
Boundary markers: Uses JSON parameter files (@params.json) when calling CLI tools to mitigate shell injection risks.
Capability inventory: Has capabilities to write files, execute shell commands, and perform network operations through the qhkit binary.
Sanitization: Relies on shell-safe parameter passing via files, but the underlying LLM processing of prompts remains susceptible to indirect injection.
[DYNAMIC_EXECUTION]: Generates and runs code snippets at runtime for image manipulation.
Uses a Python one-liner to perform image compression via the Pillow library: python -c "from PIL import Image...".
Dynamically invokes npx --yes sharp-cli for Node.js-based image processing.

linkpix-ozon-image