The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the Node.js runtime from nodejs.org and the @iqinghu/qhkit package from the npm registry (npmjs.com). It also includes instructions for using an official Alibaba mirror (npmmirror.com) as a fallback. These are well-known technology services and official distribution channels.
[PERSISTENCE]: The environment setup instructions suggest appending an export PATH command to the shell profile (~/.bashrc). This is a standard administrative task intended to ensure that the Node.js binary, installed in a user-local directory, remains available in future shell sessions.
[COMMAND_EXECUTION]: The skill instructions include a command sequence (curl | grep | sha256sum) used to verify the integrity of the downloaded Node.js binary. While the automated scanner flagged this as a potential remote code execution pattern, manual analysis confirms this is a defensive security check to ensure the file matches official SHASUMS256 before extraction.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external sources, which could lead to indirect prompt injection if malicious data is embedded in video URLs or API responses.
Ingestion points: Local file paths or public URLs provided by the user in the urls parameter; status JSON returned by the CLI tool.
Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for processing the task status output.
Capability inventory: Subprocess execution of the qhkit command; network operations for video upload and status checking.
Sanitization: The skill recommends passing parameters via a JSON file (@params.json) to mitigate shell injection and escaping issues.

qinghu-video-subtitle-remove