The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill manages the PIXAZO_API_KEY by reading from environment variables or a local file at ~/.pixazo/api-key. It instructs the agent to save the user-provided key to this file with restricted permissions (chmod 600), which is a standard and secure practice for credential management within a vendor's ecosystem.
[EXTERNAL_DOWNLOADS]: The skill instructions suggest fetching additional model reference data from https://www.pixazo.ai/models/ideogram.md and mentions an installation command npx skills add Pixazo-AI/skills. Both resources originate from the skill's official vendor infrastructure.
[COMMAND_EXECUTION]: The skill requires the agent to perform file system operations and set permissions (chmod 600) to store and protect the API key locally. These commands are necessary for the primary function of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (prompts and reference image data) which is interpolated into API requests sent to the Pixazo gateway.
Ingestion points: User-provided image descriptions and reference images (URLs or base64 data) in SKILL.md.
Boundary markers: None explicitly defined in the API request templates to delimit user input from instructions.
Capability inventory: The skill performs network POST requests using curl, Python requests, or Node.js fetch as shown in SKILL.md.
Sanitization: No specific sanitization or filtering of the user prompt is described before it is sent to the external API.

ideogram