The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides procedures for downloading the Node.js runtime and the @iqinghu/qhkit package. These downloads target official and well-known services including nodejs.org, the NPM registry, and the Aliyun npmmirror, which are standard for developers in different regions.
[COMMAND_EXECUTION]: The installation script includes a command sequence that pipes a checksum file from nodejs.org into grep and sha256sum. This is an integrity check to ensure the downloaded binary has not been tampered with, representing a high standard of security for environment setup.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data via the customCopy field (marketing text) and uploadedImages. This data is passed to the qhkit tool. The skill uses structured JSON for parameters and strictly validated presets (from qhkit image options) to minimize the risk of the agent misinterpreting embedded instructions.
[PERSISTENCE]: The instructions mention appending the Node.js binary path to ~/.bashrc. This is a routine configuration step for ensuring a locally installed runtime remains accessible across terminal sessions and is not a malicious persistence mechanism.

qinghu-main-image-set