skills/pixazo-ai/skills/assemblyai/Gen Agent Trust Hub

assemblyai

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEMETADATA_POISONINGDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [METADATA_POISONING]: Significant contradictions exist between the skill's metadata and its technical implementation.
  • The frontmatter and description claim the skill is for "Image generation/editing" and trigger on image-related requests.
  • The implementation details, operation IDs, and sample requests (using .mp3 files) all describe "Speech to Text" functionality using AssemblyAI's Universal 3 Pro model.
  • The output processing section then reverts to claiming the model returns image URLs, which is inconsistent with speech-to-text transcription results.
  • [DYNAMIC_EXECUTION]: The skill instructs the agent to dynamically load instructions and schemas at runtime.
  • It directs the agent to fetch https://www.pixazo.ai/models/assemblyai.md to determine exact parameter names and accepted values.
  • Loading instructions from a remote URL allows for the behavior of the skill to change after installation.
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of additional components from external sources.
  • It provides a command (npx skills add Pixazo-AI/skills --skill '*') to download and install a broad set of additional skills from a GitHub repository.
  • [COMMAND_EXECUTION]: The skill instructs the agent to manage files and permissions on the local system.
  • It requires creating a directory ~/.pixazo/ and a file api-key.
  • It explicitly instructs the agent to run chmod 600 on the API key file to restrict permissions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 09:01 PM