The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the Node.js runtime and its associated checksums directly from the official nodejs.org website, which is a well-known and trusted service. It also provides options to use the npmmirror.com (Alibaba) registry for package downloads in environments with restricted external access.
[COMMAND_EXECUTION]: The instructions utilize shell commands to install the vendor's package (@iqinghu/qhkit) and perform local image processing tasks using Python or Node.js. These are standard operations necessary for the skill's functionality.
[REMOTE_CODE_EXECUTION]: The skill contains automated setup logic that downloads Node.js. While such patterns are often flagged, this specific implementation is safe as it targets a trusted source (nodejs.org) and includes an explicit checksum verification step using sha256sum to ensure the integrity of the downloaded file before extraction.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided image paths and prompts for video generation. This presents a potential surface for injection; however, the risk is low because the skill uses a structured CLI tool for processing and lacks autonomous actions that could be exploited through malformed inputs.

linkpix-vidu-q3-sales