image-extender-api
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided image URLs and prompts to be processed by an external API, creating a potential vector for indirect instructions.
- Ingestion points: The
image_urlparameter in theimage-outpaint-requestAPI call (SKILL.md). - Boundary markers: No explicit delimiters or instructions to ignore embedded content are present in the prompt templates.
- Capability inventory: The skill utilizes network capabilities via
curl, Pythonrequests, and Node.jsfetchto interact with the Pixazo API Gateway (SKILL.md). It also performs file system operations to store the API key at~/.pixazo/api-key. - Sanitization: No specific validation or sanitization logic for the external
image_urlis defined. - [COMMAND_EXECUTION]: The skill documentation suggests using the
npxcommand for bulk installation of other vendor-related skills. - Evidence:
npx skills add Pixazo-AI/skills --skill '*'(SKILL.md). - [EXTERNAL_DOWNLOADS]: The skill instructions specify fetching additional documentation and parameter schemas from an external vendor-controlled domain.
- Evidence:
https://www.pixazo.ai/models/image-extender-api.md(SKILL.md).
Audit Metadata