The Agent Skills Directory

[PERSISTENCE]: The skill provides instructions to modify the user's shell profile (~/.bashrc) by appending a new directory to the PATH environment variable. This is intended to ensure that the installed Node.js binaries and the qhkit command remain available in subsequent terminal sessions.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of external video URLs (e.g., from Douyin or TikTok) provided by the user. These URLs are passed as parameters to CLI commands, creating a potential surface for indirect injection.
Ingestion points: The resourceUrl parameter within the qhkit video-inspire generate command in SKILL.md.
Boundary markers: The input is structured as a JSON string literal.
Capability inventory: The skill can execute local CLI commands (qhkit), write files (e.g., ./我的商品图.jpg), and interact with the iqinghu.com API.
Sanitization: The skill relies on the qhkit tool's internal validation of the provided URL.
[EXTERNAL_DOWNLOADS]: The skill fetches Node.js binaries and associated checksum files from the official nodejs.org servers. It also installs the @iqinghu/qhkit package from the official NPM registry or a well-known mirror (registry.npmmirror.com). These resources originate from established and well-known providers.
[COMMAND_EXECUTION]: The skill uses common shell utilities including curl, tar, and sha256sum to automate the installation and verification of the Node.js runtime environment. It also executes the qhkit command-line tool to perform video analysis, script generation, and marketing video production tasks.

qinghu-viral-video-clone