The Agent Skills Directory

[PERSISTENCE]: The skill instructions advise the agent to modify the ~/.bashrc shell configuration file to persist changes to the PATH environment variable. This ensures the custom-installed Node.js environment remains available in subsequent shell sessions.
[EXTERNAL_DOWNLOADS]: The skill performs environment setup by downloading Node.js binaries and verification files from nodejs.org, and installing the @iqinghu/qhkit package from the npm registry or its official mirror (npmmirror.com). These sources are well-known technology infrastructure providers and the installation process includes security best practices such as checksum verification.
[DYNAMIC_EXECUTION]: Shell commands for the qhkit utility are dynamically constructed at runtime using JSON payloads that incorporate user-provided inputs. This method of building executable strings creates a risk vector for how input characters are interpreted by the shell environment.
[COMMAND_EXECUTION]: The skill relies on executing the qhkit CLI tool to interact with the image generation service. This includes running commands for image production, options retrieval, and cost estimation.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user content, specifically text prompts and local file paths for images, which are then used as parameters for CLI tool execution. The ingestion points are the prompt and uploadedImages fields; the skill recommends using parameter files (@params.json) as a boundary marker to minimize shell parsing issues, but the reliance on external data for command arguments establishes a surface for injection.

qinghu-image-generate