The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches extended API reference documentation and schemas from the vendor's website at https://www.pixazo.ai/models/image-to-video-api.md. As this is the official domain of the skill author (pixazo-ai), it is considered a legitimate resource fetch.
[COMMAND_EXECUTION]: Documentation provides an npx command (npx skills add Pixazo-AI/skills --skill '*') allowing users to bulk-install other skills from the vendor's GitHub organization. This is a standard utility command for the platform.
[CREDENTIALS_UNSAFE]: The skill manages API keys by instructing the agent to save them in ~/.pixazo/api-key with chmod 600. This is a recommended security practice for local secret management, ensuring the key is stored with restricted file system permissions.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and image URLs for submission to the Pixazo API.
Ingestion points: User-provided descriptions and image_url fields in the media-image-to-video-request operation.
Boundary markers: None explicitly defined in the API request construction.
Capability inventory: The skill uses curl, Python requests, and Node.js fetch to send data to the Pixazo gateway.
Sanitization: Standard JSON encoding is used for request bodies; no specific sanitization of the input text content is performed by the skill itself, relying on the receiving API's guardrails.

image-to-video-api