image-convert-api
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to save the user's API key to a local file (
~/.pixazo/api-key) and explicitly requires setting permissions tochmod 600(owner read/write only). This is a security best practice for managing sensitive credentials on a local filesystem. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to
gateway.pixazo.aiandapi-assets.pixazo.aito process image conversion tasks. These domains are official vendor resources for Pixazo-AI and are necessary for the skill's primary functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided descriptions and external image URLs. While this constitutes an attack surface for indirect prompt injection, the risk is minimized by the skill's narrow scope (image processing) and the lack of complex downstream command execution capabilities.
- [CREDENTIALS_UNSAFE]: The skill handles an API key (
PIXAZO_API_KEY) but avoids hardcoding any secrets. Instead, it provides instructions for the agent to retrieve the key from environment variables or a secure local file.
Audit Metadata