The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches official Node.js binaries and their corresponding SHA256 checksum files from nodejs.org, a well-known service. It also uses the Alibaba npmmirror for package installation fallback, which is a reputable public repository mirror.
[COMMAND_EXECUTION]: The skill orchestrates media processing by executing the qhkit CLI. It also manages environment setup using npm for package installation and standard Linux utilities (tar, curl, sha256sum) for binary deployment.
[PERSISTENCE]: To maintain the operational environment, the instructions guide the agent to append the Node.js binary path to the user's ~/.bashrc file. This ensures the required runtime remains in the shell's PATH across multiple sessions.
[INDIRECT_PROMPT_INJECTION]: The skill processes structured JSON output from external tool calls, which serves as a data ingestion point.
Ingestion points: The agent ingests status and result data from qhkit command outputs in SKILL.md.
Boundary markers: The skill mandates that tool output must be a single line of JSON, which acts as a structural validator.
Capability inventory: The skill possesses capabilities for local file system access (reading/writing media) and shell command execution (CLI tools).
Sanitization: By enforcing strict JSON parsing and explicitly instructing the agent to report specific fields (like message or credits), the skill limits the influence of arbitrary text content returned by the tool.

qinghu-media-tools