luma
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles the PIXAZO_API_KEY by looking in environment variables, a local configuration file (~/.pixazo/api-key), or the conversation context. It appropriately guides the agent to save the key with restrictive permissions (chmod 600) to ensure the secret remains private and persistent on the user's system.
- [COMMAND_EXECUTION]: The skill provides functional code snippets for Bash, Python, and Node.js to facilitate API calls. These scripts target the vendor's official gateway (gateway.pixazo.ai) and are necessary for the skill's primary purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes user-provided strings and fetches external documentation.
- Ingestion points: User prompts for video generation and fetched documentation from www.pixazo.ai.
- Boundary markers: No explicit delimiters or instructions are used to wall off user-provided prompt content.
- Capability inventory: The skill uses network requests (POST/GET) to submit generation tasks and poll for results.
- Sanitization: Input prompts are passed directly to the API without additional filtering or sanitization by the skill instructions.
Audit Metadata