google-virtual-try-on
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to fetch and process external markdown documentation from
https://www.pixazo.ai/models/google-virtual-try-on.mdto resolve parameter details at runtime. This external content is ingested into the agent's context without explicit boundary markers or instructions to disregard embedded commands, creating a surface where instructions in the documentation could influence agent behavior. - Ingestion points: The agent is guided by
SKILL.mdto load external documentation fromwww.pixazo.aiwhen specific parameter details are needed. - Boundary markers: Absent. There are no instructions provided to the agent to isolate or treat the fetched content as untrusted data.
- Capability inventory: The skill has network access (POST requests to
gateway.pixazo.ai) and file system access (reading and writing to~/.pixazo/api-key). - Sanitization: Absent. The content is loaded directly into the agent's context for processing.
- [EXTERNAL_DOWNLOADS]: The skill performs runtime fetches of configuration and parameter documentation from the vendor's official website (
www.pixazo.ai).
Audit Metadata