The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download the Node.js runtime and its corresponding SHA256 checksums from the official nodejs.org domain. These are well-known and trusted sources for development environments.
[COMMAND_EXECUTION]: The skill utilizes command-line tools such as npm, curl, tar, and sha256sum to facilitate environment setup and package installation. It executes the vendor's qhkit CLI tool to perform the primary image generation tasks described in the skill.
[INDIRECT_PROMPT_INJECTION]: The skill has a potential attack surface by incorporating user-provided prompts and image file paths directly into shell command arguments. * Ingestion points: User input is passed to the prompt and uploadedImages fields within the JSON payload of the qhkit command. * Boundary markers: The skill uses JSON formatting to structure command parameters. * Capability inventory: The agent can execute the qhkit CLI, which performs network operations to the vendor's API and local file system access for image processing. * Sanitization: The instructions do not explicitly describe shell escaping for the interpolated user content.

qinghu-pod-pattern-variations