The Agent Skills Directory

[PERSISTENCE]: The skill instructs the agent to modify the user's shell profile (~/.bashrc) to persistently append directories to the PATH environment variable during the environment setup process.
[COMMAND_EXECUTION]: The skill performs environment bootstrapping by executing shell commands to check for tool availability, install Node.js binaries, and install NPM packages globally.
[EXTERNAL_DOWNLOADS]: The skill fetches software binaries and verification files from well-known official sources (nodejs.org) and the NPM registry (npmjs.com) to establish its execution environment.
[CREDENTIALS_UNSAFE]: The skill provides instructions for the user to input and store a sensitive API token (QHKIT_TOKEN) in configuration files or environment variables for authentication with the backend service.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests untrusted user-supplied social media URLs.
Ingestion points: Data is received via the '主页链接' field in the parameters processed by the CLI tool.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the processed data.
Capability inventory: The skill utilizes the 'qhkit' CLI for network communication and file generation based on the input data.
Sanitization: There is no documented evidence of input sanitization or validation before the data is passed to the underlying workflow engine.

qinghu-creator-data-engine