The Agent Skills Directory

[PERSISTENCE]: The skill instructions direct the agent to modify the shell profile (~/.bashrc) to ensure that the newly installed Node.js binary remains in the system PATH environment variable across different sessions.
[REMOTE_CODE_EXECUTION]: The environment setup script downloads a Node.js binary archive (.tar.xz) and uses shell commands to extract it and integrate it into the execution environment. The process includes a security-positive step of verifying the download's integrity using official SHA256 checksums from nodejs.org.
[EXTERNAL_DOWNLOADS]: The skill fetches components from well-known and reputable sources, including the official Node.js distribution server (nodejs.org) and the NPM registry (npmjs.com). It also suggests a well-known mirror (npmmirror.com) for improved access speed in restricted network environments.
[COMMAND_EXECUTION]: The skill relies on the execution of the qhkit CLI tool to perform workflow operations such as listing applications, retrieving configuration options, estimating costs, and submitting generation tasks.
[INDIRECT_PROMPT_INJECTION]: The skill processes external media files (images, videos) and complex JSON parameters supplied by users. It lacks specific boundary markers or sanitization logic for these inputs, creating a surface where malicious instructions embedded in processed data could potentially influence agent behavior or tool execution.

qinghu-workflow-apps