The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries and checksum files from the official Node.js distribution site (nodejs.org) and a well-known mirror (npmmirror.com). It correctly implements integrity verification by piping checksum files through sha256sum to validate the downloaded archives before extraction.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for installing the @iqinghu/qhkit package and running image generation tasks. These commands are standard for the tool's intended purpose.
[PERSISTENCE]: The instructions suggest adding the Node.js path to the user's ~/.bashrc file. While this is a persistence mechanism, it is used here specifically to ensure the necessary runtime environment is available for the skill in future sessions.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data, including text prompts and images, which are passed to the CLI tool.
Ingestion points: User-provided strings in the prompt and customCopy arguments, and local files in uploadedImages.
Boundary markers: None identified in the provided templates.
Capability inventory: The skill can execute shell commands (qhkit, npm) and write files to the system via the tool's output.
Sanitization: No explicit sanitization or validation of the input strings is described before they are passed to the command line.

qinghu-ecom-image