image-dpi-api
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell commands to manage local configuration and secure credentials.
- Evidence: It instructs the agent to save user-provided API keys to
~/.pixazo/api-keyand applychmod 600to restrict file permissions. - [EXTERNAL_DOWNLOADS]: The skill fetches resources from the official vendor domain.
- Evidence: The agent is instructed to fetch extended schemas and parameter definitions from
https://www.pixazo.ai/models/image-dpi-api.md. - [REMOTE_CODE_EXECUTION]: The skill references a command to install additional vendor tools.
- Evidence: A command
npx skills add Pixazo-AI/skills --skill '*'is provided for the user to add related vendor skills. - [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface for indirect prompt injection.
- Ingestion points: The skill processes external
image_urldata and fetches remote markdown instructions fromwww.pixazo.ai. - Boundary markers: None identified.
- Capability inventory: File system write and permission modification, network operations via curl/requests/fetch.
- Sanitization: None identified for processed URLs or fetched content.
Audit Metadata