The Agent Skills Directory

[SAFE]: The skill follows security best practices for credential management by instructing the agent to store the user's API key in a local file (~/.pixazo/api-key) with restricted permissions (chmod 600), ensuring the key is not exposed to other users or processes.
[EXTERNAL_DOWNLOADS]: The skill fetches model configuration and parameter details from the vendor's official domain at https://www.pixazo.ai/models/mirelo.md to ensure accuracy during API request construction.
[COMMAND_EXECUTION]: The documentation provides an npx command for users to install additional skills from the official Pixazo-AI/skills repository, which is a standard deployment mechanism for this vendor.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided prompts and external documentation, which represents a standard attack surface for indirect prompt injection.
Ingestion points: User-provided text prompts, reference images, and external model metadata fetched from pixazo.ai.
Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" markers for user-supplied data.
Capability inventory: The skill possesses file system write access for saving API keys and network request capabilities for interacting with the Pixazo API gateway.
Sanitization: No specific input sanitization or validation routines are described for the ingested prompts or fetched documentation content.
[METADATA_POISONING]: The skill's metadata contains a discrepancy; the description and triggering instructions refer to image generation and editing, while the API endpoints and sample requests are configured for sound effects (SFX) and audio generation. This is likely a documentation error and may lead to incorrect task routing by the agent.

mirelo