The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes search results from the 1688 platform via the qhkit tool, creating an attack surface where untrusted data could influence agent behavior.
Ingestion points: Data returned by qhkit mcp call and the reading of local JSON files for "large results".
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat search results as untrusted content.
Capability inventory: The skill utilizes shell commands (qhkit), performs package management (npm), and accesses the local file system.
Sanitization: No sanitization or validation steps are defined for the incoming 1688 product data.
[EXTERNAL_DOWNLOADS]: The skill contains logic to bootstrap its own environment by downloading software from external sources.
Fetches Node.js binaries and checksums from the official Node.js distribution site (nodejs.org) for Linux environments.
Downloads and installs the @iqinghu/qhkit npm package from the public npm registry or the Alibaba npm mirror (npmmirror.com).
[COMMAND_EXECUTION]: The skill relies on several shell-based operations to function and manage its dependencies.
Executes the qhkit CLI tool to perform searches and manage configuration.
Performs global package installation and updates via npm install -g.
Orchestrates environment setup on Linux using curl, tar, and sha256sum to install Node.js into the user's local directory.

qinghu-1688-keyword-search