The Agent Skills Directory

[PERSISTENCE]: The skill instructs the agent to append export commands to the user's shell profile (~/.bashrc). This ensures that the installed Node.js binaries remain in the system's PATH for future sessions.
[EXTERNAL_DOWNLOADS]: Fetches Node.js runtime binaries and integrity checksums from nodejs.org and its official mirrors (npmmirror.com). It also utilizes npm to install the vendor-specific @iqinghu/qhkit package.
[COMMAND_EXECUTION]: Executes various shell commands to set up the environment, including mkdir, tar for extraction, and sha256sum for file verification. It also uses npm and npx for package management and tool invocation.
[DYNAMIC_EXECUTION]: Uses the Python interpreter to execute a script for image resizing and optimization. The script is passed as a command-line argument using the -c flag and requires the Pillow library.
[INDIRECT_PROMPT_INJECTION]: The skill processes external content through video generation prompts and uploaded image files, creating a surface for potential injection attacks.
Ingestion points: Prompts and image paths specified in SKILL.md.
Boundary markers: None identified; untrusted data is passed directly to command arguments.
Capability inventory: Includes file system access (read/write), network access (via qhkit and npm), and subprocess execution.
Sanitization: Includes automated image compression logic but lacks explicit sanitization for text-based prompts.

linkpix-shipinhao-viral-video