happy-horse
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches updated model documentation and parameter schemas from the vendor's official domain (pixazo.ai).
- [COMMAND_EXECUTION]: The skill utilizes shell commands (curl), Python (requests), and Node.js (fetch) to communicate with the Pixazo API gateway.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from an external vendor-controlled URL to determine operational parameters. 1. Ingestion points: The Fetch command in SKILL.md targets external markdown documentation. 2. Boundary markers: None specified for the fetched content. 3. Capability inventory: Subprocess calls via curl, network requests, and file system access for credential storage in SKILL.md. 4. Sanitization: No explicit sanitization of the fetched documentation is mentioned.
Audit Metadata