The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to download and install Node.js binaries directly from nodejs.org or its official mirror (npmmirror.com) when the environment lacks the necessary runtime.
Evidence: curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz followed by extraction and PATH modification.
Security Note: The instructions include a mandatory integrity check using SHA256 checksums (sha256sum -c -) before execution, following security best practices for manual binary installation.
[COMMAND_EXECUTION]: The skill relies on executing the qhkit CLI tool and standard system utilities (npm, curl, tar) to perform its primary functions.
Evidence: Invocations of qhkit video generate, npm i -g @iqinghu/qhkit, and python -c for image processing.
[PERSISTENCE]: The installation guide suggests appending the Node.js path to the user's shell configuration file to ensure the runtime remains available in future sessions.
Evidence: Instructions to append export PATH=... to ~/.bashrc.
[INDIRECT_PROMPT_INJECTION]: The skill represents a vulnerability surface for indirect prompt injection as it processes untrusted user data (prompts and images) and passes them to an external CLI tool and remote API.
Ingestion points: User-supplied prompt and uploadedImages in SKILL.md.
Boundary markers: None explicitly mentioned in the command construction.
Capability inventory: File system read/write, network operations via qhkit and curl, and subprocess execution via Python/Node.js.
Sanitization: The CLI tool qhkit is described as having content auditing, but the skill itself does not perform pre-processing validation on the prompt text.

linkpix-wanx-3-sales