ltx
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and follow API specifications from a remote Markdown file located at the official vendor domain (https://www.pixazo.ai/models/ltx.md).\n
- Ingestion points: The agent is instructed to load documentation from the developer's website to identify correct API parameters.\n
- Boundary markers: No explicit delimiters or instructions are provided to the agent to prevent the execution of potentially malicious commands embedded in the external documentation.\n
- Capability inventory: The skill uses network operations (via
curl,requests, andfetch) and writes to the local file system (~/.pixazo/api-key).\n - Sanitization: No content filtering or sanitization is specified for the data retrieved from the remote source.\n- [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install additional skill modules from the vendor's repository using the
npx skills addcommand.\n- [DATA_EXPOSURE]: The skill instructions involve reading and writing a sensitive API key to a local configuration file (~/.pixazo/api-key), though it specifies secure file permissions (chmod 600).
Audit Metadata