pixoo64
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of a local command-line utility
pixoo-clito control hardware devices. This is the primary intended function of the skill and involves standard operations such as setting brightness, changing display channels, and managing device settings via shell commands. - [EXTERNAL_DOWNLOADS]: The documentation points users to the official GitHub releases page of the
glaforge/jixoorepository to download the requiredpixoo-clibinary. As this is the vendor's own repository for the skill's dependencies, it is considered safe and follows the trusted vendor resource pattern. - [REMOTE_CODE_EXECUTION]: The skill provides examples of using
curlto interact with Google's Gemini API (generativelanguage.googleapis.com) for image and video generation. These are standard API calls to a well-known service using the user's ownGEMINI_API_KEYand do not constitute malicious remote code execution. - [DATA_EXFILTRATION]: While the skill uses network operations (
curl) and handles an API key (GEMINI_API_KEY), there is no evidence of sensitive local data being transmitted to unauthorized third parties. The network activity is limited to official Google APIs and the Divoom cloud for the skill's stated purpose of pixel art generation and discovery.
Audit Metadata