The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries directly from the official nodejs.org repository and the @iqinghu/qhkit package from the NPM registry.
[COMMAND_EXECUTION]: The skill uses shell commands to verify the integrity of downloaded files using sha256sum. This is a security best practice to ensure the downloaded binary has not been tampered with.
[PERSISTENCE]: To ensure the tool remains available across sessions, the skill provides instructions to append the local binary path to the user's ~/.bashrc file.
[REMOTE_CODE_EXECUTION]: Automated scanners flagged a command piping curl output to a utility chain. However, analysis confirms this pipe is directed to grep and sha256sum for cryptographic verification, not to a shell for execution. This is a false positive for malicious activity and represents a safe, defensive coding practice.
[CREDENTIALS_UNSAFE]: The skill facilitates API authentication by guiding the user to retrieve a token from the vendor's official dashboard and store it in the tool's configuration or an environment variable, which is a standard and secure practice for CLI tools.

linkpix-video-translate