skills/pixazo-ai/skills/muse-image/Gen Agent Trust Hub

muse-image

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions and examples for using shell commands (curl) and language-specific HTTP clients (Python requests, Node.js fetch) to perform operations against the Pixazo API gateway.
  • [EXTERNAL_DOWNLOADS]: The agent is instructed to fetch technical documentation from https://www.pixazo.ai/models/muse-image.md to resolve API parameter schemas. This is a vendor-controlled resource intended for legitimate operational context.
  • [INDIRECT_PROMPT_INJECTION]: The process of fetching and interpreting external documentation at runtime introduces an indirect prompt injection surface. If the remote source were compromised, malicious instructions could be embedded in the documentation to influence agent logic.
  • Ingestion points: The agent is directed to retrieve content from https://www.pixazo.ai/models/muse-image.md within the 'Full reference' section of SKILL.md.
  • Boundary markers: The skill does not define specific delimiters or instructions for the agent to treat the fetched documentation as untrusted data.
  • Capability inventory: The skill has access to network tools (curl, requests, fetch) and file system access for reading/writing configuration files.
  • Sanitization: There are no specific instructions to validate or sanitize the external documentation before processing its content for parameter definitions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 09:01 PM