The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions require the agent to search for and store secrets in ~/.pixazo/api-key, which is a sensitive local file path.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input that is subsequently sent to an external API.
Ingestion points: Music generation parameters like prompt and lyrics defined in the trigger and sample requests in SKILL.md.
Boundary markers: No specific delimiters or safety instructions are provided to separate user input from system instructions.
Capability inventory: The skill utilizes network requests (via curl, Python requests, and Node.js fetch) and local file system write operations to ~/.pixazo/api-key.
Sanitization: No input validation or sanitization logic is specified for the prompt data.
[EXTERNAL_DOWNLOADS]: The skill fetches reference documentation and parameter schemas from the vendor's website at https://www.pixazo.ai/models/ace-step.md.
[COMMAND_EXECUTION]: The skill provides examples for executing curl commands and refers to the npx utility for managing additional vendor skills.

ace-step