The Agent Skills Directory

[DATA_EXPOSURE]: The skill manages a vendor-specific API key stored in ~/.pixazo/api-key. It correctly instructs the agent to set restrictive file permissions (chmod 600) to protect the credential.
[EXTERNAL_DOWNLOADS]: The skill references and fetches documentation and configuration from the vendor's official domain (pixazo.ai) and gateway (gateway.pixazo.ai). These are legitimate vendor resources used for the skill's primary functionality.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text and audio URLs from the user to process them via the TTS API. While this creates a potential surface for indirect prompt injection, the data is passed to a specific vendor endpoint for processing, and no unsafe interpolation into system instructions was detected.

chatterbox