The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the Node.js runtime environment from nodejs.org and the @iqinghu/qhkit package from the npm registry. These are well-known, trusted services. The installation process includes a security best practice of verifying the binary's SHA256 checksum before extraction.
[PERSISTENCE]: The skill instructions direct the agent to modify the user's shell configuration file (~/.bashrc) to append the Node.js binary directory to the PATH environment variable. While this is standard for setting up local binary environments, it is a persistence mechanism that ensures the modified path persists across new shell sessions.
[COMMAND_EXECUTION]: The skill relies on the execution of the qhkit command-line tool. It provides templates for generating images based on user-supplied prompts.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text descriptions and interpolates them into a shell command for the qhkit tool. Ingestion points: User-supplied prompt strings defined in the 'Use Cases' section of SKILL.md. Boundary markers: None present in the interpolation template. Capability inventory: Execution of the qhkit CLI tool with file-system and network access. Sanitization: The skill documentation recommends using a parameters file (@params.json) to avoid shell escaping issues, though the primary example uses direct string interpolation.

qinghu-clothing-recolor