The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download Node.js from nodejs.org and install the qhkit CLI from the official NPM registry. These are trusted and well-known sources. It also suggests using reputable mirrors like npmmirror for network reliability.
[REMOTE_CODE_EXECUTION]: Automated scans flagged a command sequence involving curl piped to utilities. Analysis confirms this is a security best practice that pipes a checksum file to sha256sum to verify the integrity of the Node.js binary, rather than executing untrusted remote scripts.
[COMMAND_EXECUTION]: The skill uses local commands such as qhkit, python (for PIL image processing), and node (via npx) for image-related tasks. These are used for their intended functional purposes within the skill's scope.
[INDIRECT_PROMPT_INJECTION]: The skill accepts untrusted data through parameters like customCopy, prompt, and uploadedImages (referenced in SKILL.md). While this creates an injection surface, it is necessary for the tool's core AIGC functionality and is typically managed by model-level safety guardrails.
[CREDENTIALS_UNSAFE]: The skill follows secure practices by instructing users to configure API tokens through CLI settings or environment variables, avoiding the use of hardcoded credentials.

linkpix-temu-image