The Agent Skills Directory

[PERSISTENCE]: The skill instructions advise the agent to modify shell configuration files, specifically ~/.bashrc, to persist environment variable changes (specifically adding newly installed Node.js binaries to the PATH). While this facilitates the long-term use of the tool within the environment, modification of user startup scripts is a common technique used for maintaining persistence on a system.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of local file paths or public URLs for video processing via the urls parameter in SKILL.md. These inputs are interpolated into shell commands for the qhkit CLI tool. The instructions do not define boundary markers or include specific directives to ignore instructions embedded in the metadata of these files, leaving a potential opening for indirect prompt injection if the files contain malicious filenames or embedded metadata.
[EXTERNAL_DOWNLOADS]: The skill provides procedures for downloading and installing external software, including the Node.js runtime environment and the @iqinghu/qhkit package. These downloads target official repositories such as nodejs.org and the NPM registry (including the well-known mirror registry.npmmirror.com). These downloads are performed during the environment setup phase to ensure dependencies are met.
[COMMAND_EXECUTION]: The skill relies on the execution of multiple system commands and CLI tools for its functionality. This includes setup commands like npm, tar, and sha256sum, as well as the primary video processing operations using qhkit. These commands are executed based on the user's request for video enhancement.

qinghu-video-upscale