The Agent Skills Directory

[PERSISTENCE]: The skill provides instructions for the agent to modify shell profile files (e.g., ~/.bashrc) to ensure that the PATH for the Node.js binary remains set across different shell sessions.
[EXTERNAL_DOWNLOADS]: The skill downloads the Node.js runtime binary from nodejs.org and installs the @iqinghu/qhkit package from the npm registry. It also suggests using a well-known mirror (registry.npmmirror.com) if the primary registry is unavailable. These sources are considered well-known or vendor-owned.
[INDIRECT_PROMPT_INJECTION]: The skill processes content from external video URLs and user-uploaded images, which could potentially contain malicious instructions intended to influence the agent's behavior.
Ingestion points: Video URLs (resourceUrl) and local image paths (uploadedImages) passed to the qhkit CLI tool.
Boundary markers: There are no explicit delimiters or system instructions provided to the agent to ignore or isolate content found within these external sources.
Capability inventory: The agent can execute system commands, access the network via the vendor tool, and modify configuration files.
Sanitization: No sanitization or validation steps are defined for the input retrieved from external URLs or images.
[COMMAND_EXECUTION]: The skill uses shell commands to install prerequisites, verify file integrity using sha256sum, and execute the qhkit utility for its core functionality.

linkpix-sales-script