The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input (image prompts and reference images) which is interpolated into API requests sent to the external Pixazo gateway. This is a standard surface for potential prompt injection targeting the underlying image generation model.
Ingestion points: Textual prompts and reference image data/URLs provided by the user (SKILL.md).
Boundary markers: No explicit delimiters or boundary markers are used to isolate user input within the JSON request structure.
Capability inventory: The skill performs network operations via curl, Python requests, and Node.js fetch targeting gateway.pixazo.ai (SKILL.md).
Sanitization: No sanitization or content filtering of the user's prompt is performed before transmission to the API.
[SAFE]: The skill implements secure credential management by instructing the agent to store the user's API key in a local configuration file (~/.pixazo/api-key) with restricted permissions (chmod 600), preventing other users on the system from accessing the secret.
[SAFE]: All remote interactions, including API calls to gateway.pixazo.ai and documentation fetches from pixazo.ai, are directed to the vendor's official infrastructure, which represents standard and intended functionality.

gpt-image