bria
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute network requests using curl, Python requests, and Node.js fetch to interact with the vendor's API gateway at gateway.pixazo.ai.
- [CREDENTIALS_UNSAFE]: The skill manages a Pixazo API key by checking environment variables and a vendor-specific local file (~/.pixazo/api-key). It correctly instructs the agent to secure this file using chmod 600.
- [INDIRECT_PROMPT_INJECTION]: Ingestion points: User-provided prompt strings are used as input for the virtual try-on and image generation API calls. Boundary markers: There are no boundary markers or instructions to ignore instructions within the prompt. Capability inventory: The skill uses network request capabilities. Sanitization: No input sanitization is specified for the prompt data.
- [SAFE]: All identified behaviors and resources, including API domains and credential paths, are associated with the official pixazo-ai vendor and represent intended, legitimate functionality.
Audit Metadata