skills/glaforge/jixoo/pixoo64/Gen Agent Trust Hub

pixoo64

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of a local command-line utility pixoo-cli to control hardware devices. This is the primary intended function of the skill and involves standard operations such as setting brightness, changing display channels, and managing device settings via shell commands.
  • [EXTERNAL_DOWNLOADS]: The documentation points users to the official GitHub releases page of the glaforge/jixoo repository to download the required pixoo-cli binary. As this is the vendor's own repository for the skill's dependencies, it is considered safe and follows the trusted vendor resource pattern.
  • [REMOTE_CODE_EXECUTION]: The skill provides examples of using curl to interact with Google's Gemini API (generativelanguage.googleapis.com) for image and video generation. These are standard API calls to a well-known service using the user's own GEMINI_API_KEY and do not constitute malicious remote code execution.
  • [DATA_EXFILTRATION]: While the skill uses network operations (curl) and handles an API key (GEMINI_API_KEY), there is no evidence of sensitive local data being transmitted to unauthorized third parties. The network activity is limited to official Google APIs and the Divoom cloud for the skill's stated purpose of pixel art generation and discovery.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 11:58 AM