The Agent Skills Directory

[PERSISTENCE]: The skill instructs the agent to append path export commands to the shell profile (~/.bashrc). This is a persistence mechanism intended to maintain access to the Node.js binary across shell sessions.
[EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries and checksums from nodejs.org, an official well-known service, and installs the @iqinghu/qhkit package from the npm registry. These are required external dependencies for the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by processing untrusted data. Ingestion points: Processes output from the qhkit workflow options and qhkit workflow status commands and accepts user-provided video (.mp4) and image (.jpg) files as specified in SKILL.md. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the processing logic. Capability inventory: The skill can execute shell commands, install npm packages, download external files via curl, and perform file system operations like tar extraction. Sanitization: There is no evidence of validation or sanitization for the data returned by the CLI tool or found within the metadata of user files before they are used to influence agent behavior.
[COMMAND_EXECUTION]: The skill utilizes multiple shell commands for environment configuration and task execution, including curl, tar, npm, and the qhkit CLI tool.

qinghu-duo-viral-video