The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several system commands including curl, tar, npm, and sha256sum to facilitate the setup of its operating environment. It also executes the qhkit CLI tool to perform advertising film generation tasks.
[EXTERNAL_DOWNLOADS]: The skill documentation includes steps to fetch Node.js binaries from nodejs.org and the @iqinghu/qhkit package from official NPM registries. These downloads target well-known and reputable service providers.
[PERSISTENCE]: The skill provides instructions for the agent to append a PATH modification command (export PATH=...) to the user's ~/.bashrc file. While this is a common developer practice for maintaining access to binaries, it technically constitutes a persistence mechanism within the shell environment.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests untrusted data from params.json fields such as '产品名称' (Product Name), '核心卖点' (Selling Points), and '目标人群' (Target Audience) as seen in SKILL.md.
Boundary markers: There are no explicit delimiters or safety instructions provided to the agent to distinguish between data and commands within these fields.
Capability inventory: The skill has the capability to execute shell commands (qhkit), read local product images, and perform network operations through the vendor's API.
Sanitization: The instructions do not define any sanitization or validation logic for the text strings before they are processed by the AI generation workflow.

qinghu-tvc-ad-film