The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by ingesting untrusted user prompts and remote documentation which are used to influence the agent's behavior.\n
Ingestion points: User-provided prompt and negative_prompt variables in SKILL.md, and the remote reference file mmaudio.md fetched from pixazo.ai.\n
Boundary markers: Absent; the skill does not define delimiters or instructions to ignore potential commands embedded in the prompts.\n
Capability inventory: The skill performs network operations using curl, Python requests, and Node.js fetch to interact with the gateway.pixazo.ai API.\n
Sanitization: No sanitization or validation logic is present for the external data ingested.\n- [DATA_EXFILTRATION]: The skill reads the PIXAZO_API_KEY from environment variables or the local file ~/.pixazo/api-key and transmits it to gateway.pixazo.ai. This is the intended use of the credential for authenticating with the vendor's API.\n- [EXTERNAL_DOWNLOADS]: The skill fetches model-specific documentation and schemas from https://www.pixazo.ai/models/mmaudio.md. This is a legitimate reference to the vendor's official documentation.\n- [COMMAND_EXECUTION]: The skill provides the agent with shell commands (curl, chmod) and scripts (Python, Node.js) to execute for API interaction and local file management.

mmaudio