hunyuan
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches updated API documentation and polling schemas from the vendor's official website (pixazo.ai). This allows the agent to maintain compatibility with the latest API parameter structures without downloading executable code.- [DATA_EXPOSURE]: Manages the vendor-specific API key by storing it in a dedicated local file. The skill explicitly instructs the agent to apply restrictive file permissions (chmod 600), ensuring the credential is only accessible by the owner.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided prompts and external documentation to construct API requests for 3D generation.
- Ingestion points: User-provided text/image prompts and external reference documentation from https://www.pixazo.ai/models/hunyuan.md.
- Boundary markers: None explicitly defined in the prompt construction.
- Capability inventory: Performs network requests (POST/GET) to gateway.pixazo.ai and has file write access to the specific credential path.
- Sanitization: Input is passed to the vendor API gateway; no specific client-side sanitization is implemented in these instructions.
Audit Metadata