The Agent Skills Directory

[DATA_EXPOSURE_&_EXFILTRATION]: The skill manages a service-specific API key by storing it in a local configuration file (~/.pixazo/api-key) with appropriate file permissions (chmod 600). This is a standard credential management practice for CLI-based agent tools. The key is transmitted exclusively to the vendor's API gateway (gateway.pixazo.ai).
[EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to fetch reference documentation from the vendor's official website (www.pixazo.ai). It also mentions a command to install additional vendor skills via npx. These resources are within the vendor's own ecosystem and do not represent a security escalation.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts for video generation and ingests external documentation. While this represents a standard injection surface, the risk is minimized by the skill's specific focus on API parameters and the use of the vendor's own documentation sources.
Ingestion points: User-provided prompts and documentation fetched from https://www.pixazo.ai/models/hunyuan-video.md.
Boundary markers: None explicitly defined for external content ingestion.
Capability inventory: File system write access (~/.pixazo/api-key), shell command execution (curl), and network request capabilities (requests, fetch).
Sanitization: No specific sanitization or validation logic is applied to the ingested documentation content.

hunyuan-video