The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches the Node.js binary and associated checksums from the official nodejs.org website to satisfy environment dependencies. It also installs the vendor-supplied @iqinghu/qhkit package from the npm registry.
[PERSISTENCE]: Instructions guide the agent to modify the user's shell profile (~/.bashrc) to ensure the Node.js binary remains in the system PATH across sessions, which is a persistent modification of the host environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user instructions and interpolates them directly into the JSON payload for the face-swapping tool.
Ingestion points: User-provided prompt and uploadedImages in SKILL.md examples.
Boundary markers: None; user input is treated as raw data within the tool's JSON command structure.
Capability inventory: The skill executes the qhkit CLI tool, which communicates with external APIs to process media files.
Sanitization: The skill does not perform escaping or validation of user-provided prompt content before tool invocation.
[COMMAND_EXECUTION]: Executes shell commands to install software (npm install), manage file systems (mkdir, tar), and run the qhkit command-line utility.

qinghu-model-face-swap