The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries from official sources (nodejs.org) and installs the @iqinghu/qhkit package from the NPM registry. It also mentions the use of Alibaba's NPM mirror (npmmirror.com), which is a well-known and trusted service for network failover.
[COMMAND_EXECUTION]: The skill executes the qhkit command-line tool to generate images. During the environment setup phase in SKILL.md, it uses a shell pipeline to verify the integrity of the downloaded Node.js binary using sha256sum -c - before proceeding with extraction.
[PERSISTENCE]: The installation instructions suggest appending the Node.js binary path to the user's ~/.bashrc file. This is a standard and transparent procedure for configuring the environment path for command-line tools across sessions.
[INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided image paths and descriptive text prompts to generate mockups, creating a surface for potential indirect instructions.
Ingestion points: Processes user-provided image filenames and text descriptions via shell arguments in SKILL.md.
Boundary markers: Uses structured JSON to pass arguments to the CLI tool, though it lacks explicit instructions to the model to ignore embedded commands within the prompt text.
Capability inventory: Performs file reads of local images and network operations via the qhkit CLI to interact with the vendor's image generation API.
Sanitization: No explicit sanitization of the user-provided text or image metadata is performed within the skill instructions.

linkpix-pod-pattern-apply