The Agent Skills Directory

[PERSISTENCE]: The skill provides instructions to append environment configuration (export PATH) to ~/.bashrc, which ensures the downloaded Node.js environment is automatically loaded in all future shell sessions.
[PRIVILEGE_ESCALATION]: The instructions recommend global installation of Node.js packages using npm i -g, which frequently requires administrative or sudo privileges on many systems.
[REMOTE_CODE_EXECUTION]: The skill downloads binary archives (.tar.xz) from nodejs.org and extracts them for execution. While the skill includes a safety step to verify these downloads using sha256sum before extraction, this remains a pattern of downloading and running external binary code.
[EXTERNAL_DOWNLOADS]: Fetches software components from external sources including nodejs.org and uses registry.npmmirror.com (a well-known Alibaba mirror) as a fallback for package installations.
[DYNAMIC_EXECUTION]: Uses python -c for on-the-fly execution of image processing code and npx to dynamically download and run the sharp-cli utility.
[INDIRECT_PROMPT_INJECTION]: The skill accepts external video links (e.g., Douyin, TikTok) and processes their content via the video-inspire command to generate scripts, which presents a surface for processing untrusted data that could contain malicious instructions.
[COMMAND_EXECUTION]: The skill heavily relies on executing shell commands via qhkit, npm, curl, and tar to manage its environment and perform video processing tasks.

linkpix-vidu-q2-clone