The Agent Skills Directory

[PERSISTENCE]: The skill instructions suggest modifying the user's shell profile by appending an export command to the ~/.bashrc file. This is intended to persist changes to the PATH environment variable so that the installed Node.js binaries remain accessible in future sessions.
[EXTERNAL_DOWNLOADS]: The skill downloads Node.js binaries and checksum files from official servers at nodejs.org. It also fetches the @iqinghu/qhkit package from the npm registry or the npmmirror.com mirror. These sources are recognized as official distribution points for the respective software.
[COMMAND_EXECUTION]: The skill utilizes shell commands to manage environment setup, including archive extraction (tar), file downloading (curl), and security validation (sha256sum). The agent is instructed to verify the integrity of downloaded binaries using official SHA256 hashes before proceeding with installation.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes external data such as video URLs and task IDs. While it uses structured JSON for command parameters and restricts certain labels to predefined candidates, the ingestion of external content presents a theoretical path for malicious instructions, categorized as low risk due to existing boundary markers.

qinghu-video-translate