The Agent Skills Directory

[PERSISTENCE]: The skill provides instructions to modify the user's shell profile (~/.bashrc) to persist changes to the PATH environment variable. This is a persistence mechanism that ensures the custom Node.js installation remains active across sessions.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, specifically Douyin, TikTok, and other video sharing platforms via the resourceUrl parameter. This creates a surface for indirect prompt injection where malicious instructions could be embedded in the metadata or content of the linked pages.
Ingestion points: resourceUrl parameter in qhkit video-inspire generate (SKILL.md).
Boundary markers: The skill instructs the agent to "rewrite" the script and obtain user confirmation before final submission, which acts as a manual boundary.
Capability inventory: Subprocess execution of qhkit, python, and npx; network requests via curl and npm.
Sanitization: Relies on the agent to manually rewrite and the user to verify output; no automated sanitization is specified.
[DYNAMIC_EXECUTION]: The skill generates and executes shell commands that include Python and Node.js code snippets at runtime.
Evidence: Uses python -c to execute a script for image compression using the Pillow library.
Evidence: Uses npx --yes sharp-cli to perform image resizing.
[EXTERNAL_DOWNLOADS]: The skill performs several external downloads during its environment bootstrap phase.
Evidence: Downloads Node.js binaries and checksum files from nodejs.org.
Evidence: Installs the @iqinghu/qhkit package from the NPM registry, with optional use of the npmmirror.com mirror.
Evidence: Fetches the Pillow Python library from the tsinghua.edu.cn mirror if missing.

linkpix-vidu-q3-clone