The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the Node.js runtime from nodejs.org and the @iqinghu/qhkit utility from the npm registry. These are official and well-known sources for software dependencies.
[REMOTE_CODE_EXECUTION]: The setup process involves downloading and executing external binaries and packages. The instructions include a security verification step using SHA256 checksums to ensure the integrity of the downloaded Node.js archive before extraction.
[PERSISTENCE]: The documentation suggests adding an export PATH command to the user's ~/.bashrc file. This modification ensures the newly installed tools remain available in future terminal sessions, which is a common practice for command-line tool configuration.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process and translate text within images, which creates a surface for indirect prompt injection if an image contains malicious text meant to subvert the AI's instructions. Ingestion points include local files and external URLs processed by the qhkit tool. Boundary markers are present as arguments are passed in a structured JSON format. Capability inventory includes shell execution and network access for image processing. No specific sanitization of image-embedded text is detailed in the instructions.

qinghu-image-translate