The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of necessary dependencies from trusted and well-known sources. It provides instructions to download the Node.js runtime from official repositories at nodejs.org and installs the @iqinghu/qhkit package from the standard NPM registry or a well-known mirror (npmmirror.com).
[COMMAND_EXECUTION]: The skill interacts with the user's environment by executing the qhkit command-line utility. These executions are intended for core functionality such as pattern generation, cost estimation, and configuration management. The commands use structured JSON inputs to minimize shell injection risks.
[INDIRECT_PROMPT_INJECTION]: As the skill processes external image files and user-defined prompts for image generation, it possesses an attack surface for indirect prompt injection. However, the use of structured CLI arguments and the nature of the output (image generation) significantly mitigate the risk of these inputs influencing the agent's logic or downstream actions.
[SAFE]: The environment self-bootstrap process includes a security-conscious step using sha256sum to verify the integrity of the downloaded Node.js binary before extraction. Additionally, the skill adheres to secret management best practices by instructing users to obtain their own API tokens from the official service dashboard and use environment variables or CLI configuration rather than hardcoding credentials.

qinghu-pod-pattern-extract