The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download Node.js binaries directly from nodejs.org and install the @iqinghu/qhkit package from the official NPM registry or a well-known Alibaba mirror (npmmirror.com). These are established and trusted services.
[COMMAND_EXECUTION]: The instructions involve executing shell commands to configure the environment, manage packages, and interact with the video processing API via the qhkit CLI tool.
[PERSISTENCE]: The skill suggests appending the Node.js binary path to the user's ~/.bashrc file. While modifying shell profiles is a persistence technique, in this context it is a standard and legitimate method for configuring the execution environment for developer tools.
[DYNAMIC_EXECUTION]: The skill uses python -c and npx to execute inline scripts for image processing (compression and resizing) as a fallback mechanism. These operations are performed on local files using established libraries like Pillow and Sharp.
[INDIRECT_PROMPT_INJECTION]: The skill processes external video links and scripts which represent a potential injection surface. However, the skill includes a mandatory evidence chain for safety:
Ingestion points: External short-video URLs (TikTok, Douyin, etc.) processed by qhkit video-inspire.
Boundary markers: Present; instructions require the agent to present the "Original Script vs. Rewritten Script" for user verification before proceeding.
Capability inventory: File system writes (temporary files), network access (API calls via qhkit), and subprocess execution (Python/Node for image processing).
Sanitization: Relies on LLM rewriting and explicit human-in-the-loop confirmation before task submission.

linkpix-seedance-25-clone