The Agent Skills Directory

[PERSISTENCE]: The skill instructs the agent or user to append environment configuration commands (export PATH) to the ~/.bashrc shell profile file. This allows the installed Node.js and qhkit binaries to remain accessible in future terminal sessions, which constitutes a persistence mechanism.- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via user-provided data. 1. Ingestion points: External video URLs and image files are ingested through parameters like originalVideoUrl and uploadedImages in SKILL.md. 2. Boundary markers: There are no explicit delimiters or instructions to the model to ignore potential malicious content embedded in the media metadata or source. 3. Capability inventory: The skill possesses the capability to execute subprocess commands via the qhkit CLI. 4. Sanitization: No sanitization or verification of the external media content is performed prior to processing.- [EXTERNAL_DOWNLOADS]: The skill downloads the Node.js binary and its corresponding SHA256 checksum file from nodejs.org, which is a well-known and trusted service. It also facilitates the installation of the @iqinghu/qhkit package from the npm registry or its Alibaba Cloud mirror (npmmirror.com). The installation process includes a security best practice by verifying the file integrity using sha256sum.

linkpix-video-role-swap