The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user inputs, creating a potential surface for indirect prompt injection. Ingestion points: User-provided text prompts and reference image data (URLs or base64) are ingested in SKILL.md to construct API requests. Boundary markers: The instructions do not define specific delimiters or "ignore" instructions to separate user-supplied content from system commands. Capability inventory: The skill is capable of performing network POST operations to gateway.pixazo.ai across all documented scripts. Sanitization: While the skill includes an enable_safety_checker flag in the payload, it does not specify any sanitization or validation of input strings before transmission.
[COMMAND_EXECUTION]: The skill directs the agent to manage file system permissions for credential storage. Evidence: Instructions in SKILL.md guide the agent to save the API key to ~/.pixazo/api-key and apply chmod 600 to the file. This is a secure method for handling local secrets.
[EXTERNAL_DOWNLOADS]: The skill retrieves technical documentation from an external resource. Evidence: The agent is instructed to fetch comprehensive model reference data from https://www.pixazo.ai/models/hidream.md as needed.

hidream