The Agent Skills Directory

[PERSISTENCE]: The skill provides explicit instructions to modify the user's shell profile. It directs the agent to append environment variable exports and path modifications to ~/.bashrc, ensuring that the installed Node.js binaries and associated tools persist across future shell sessions.\n- [EXTERNAL_DOWNLOADS]: The skill downloads binaries and software packages from remote repositories. This includes fetching Node.js archives from nodejs.org (a well-known service) and installing the qhkit package from the npm registry. The skill correctly incorporates security best practices by performing a SHA256 integrity check on the Node.js binary archive before extraction, which helps mitigate risks associated with corrupted or tampered downloads.\n- [COMMAND_EXECUTION]: The skill relies on extensive shell command execution for both its installation phase and operational logic. Commands include curl for downloading assets, tar for extraction, npm for package management, and direct invocation of the qhkit CLI tool to perform video processing tasks.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, creating an attack surface for indirect prompt injection.\n
Ingestion points: The skill accepts user-provided media files (videos and images) as input, either via local file paths or remote URLs (originalVideoUrl, uploadedImages).\n
Boundary markers: The skill establishes that tool output will be structured as a single-line JSON string, providing a consistent format for the agent to parse.\n
Capability inventory: The skill leverages shell execution, network access for media uploads, and file system read/write permissions.\n
Sanitization: The instructions proactively recommend using a JSON parameter file (@params.json) to pass arguments to the CLI tool, which effectively prevents common shell command injection vulnerabilities compared to passing raw string arguments.

qinghu-video-role-swap