The Agent Skills Directory

[PERSISTENCE]: The skill provides instructions to append environment variable exports to the user's shell profile (~/.bashrc). This is intended to ensure that the manually installed Node.js binary remains in the system PATH for future sessions.
[EXTERNAL_DOWNLOADS]: The skill downloads the Node.js runtime environment from nodejs.org and suggests npmmirror.com as a fallback. It follows security best practices by including a step to verify the download's integrity using sha256sum against the official SHASUMS256.txt file.
[COMMAND_EXECUTION]: The skill relies on installing and executing a third-party CLI tool, @iqinghu/qhkit, via npm. It executes various subcommands of qhkit to process images and manage configuration.
[INDIRECT_PROMPT_INJECTION]: The skill takes user-provided image paths and descriptive prompts and interpolates them into a JSON string passed to the qhkit command. Although the skill suggests using a file-based input method (@params.json) to prevent shell escape issues, the reliance on unvalidated user-controlled text strings within a shell command represents a surface for indirect injection.

linkpix-product-swap