The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill manages authentication by checking for a PIXAZO_API_KEY in environment variables or a local configuration file (~/.pixazo/api-key). This is a standard and secure approach for persistent API authentication in agentic workflows.
[PRIVILEGE_ESCALATION]: The agent is instructed to set file permissions to chmod 600 when saving the API key locally. This practice follows the principle of least privilege by ensuring that the secret file is only accessible by the owner.
[EXTERNAL_DOWNLOADS]: The skill references a Markdown file at https://www.pixazo.ai/models/lucy-edit.md to retrieve technical schemas and status polling logic. This resource belongs to the skill's vendor and is used to maintain accurate operational context.
[DATA_EXFILTRATION]: Network operations are restricted to the vendor's API gateway (gateway.pixazo.ai). The skill only transmits user-provided prompts and video URLs to the service provider's infrastructure for processing, with no evidence of unauthorized third-party data transfers.
[COMMAND_EXECUTION]: The documentation includes standard shell examples (curl) and mentions a platform-specific command for adding skills (npx skills add). These are instructional and interact with legitimate vendor repositories and tools.

lucy-edit