The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download the Node.js runtime from the official nodejs.org distribution server. The procedure includes a mandatory step to verify the file's integrity using SHA-256 checksums before installation, which is a security best practice.
[DYNAMIC_EXECUTION]: To handle image size limitations, the skill instructs the agent to generate and execute a Python one-liner using the Pillow library to resize and compress local image files. This is a defined utility function but involves runtime code generation based on file paths.
[COMMAND_EXECUTION]: The skill relies on executing the vendor's CLI tool (qhkit) for video generation and status checking. It also includes instructions for managing dependencies via npm and pip.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests untrusted data in the form of user-provided text prompts, and local image and video files (specifically uploadedImages, uploadedVideo, and uploadedAudio parameters defined in SKILL.md).
Boundary markers: The instructions use JSON formatting for CLI tool parameters, which provides structured encapsulation but does not inherently sanitize embedded natural language instructions within the data.
Capability inventory: The skill possesses capabilities to read and write files (for image processing), execute shell commands (qhkit), and perform network requests (via the CLI tool and installation commands).
Sanitization: The skill includes explicit instructions for the agent to validate and compress image files if they exceed the 10MB limit before passing them to the generation tool.

linkpix-seedance-2-sales