muse-image
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions and examples for using shell commands (
curl) and language-specific HTTP clients (Pythonrequests, Node.jsfetch) to perform operations against the Pixazo API gateway. - [EXTERNAL_DOWNLOADS]: The agent is instructed to fetch technical documentation from
https://www.pixazo.ai/models/muse-image.mdto resolve API parameter schemas. This is a vendor-controlled resource intended for legitimate operational context. - [INDIRECT_PROMPT_INJECTION]: The process of fetching and interpreting external documentation at runtime introduces an indirect prompt injection surface. If the remote source were compromised, malicious instructions could be embedded in the documentation to influence agent logic.
- Ingestion points: The agent is directed to retrieve content from
https://www.pixazo.ai/models/muse-image.mdwithin the 'Full reference' section ofSKILL.md. - Boundary markers: The skill does not define specific delimiters or instructions for the agent to treat the fetched documentation as untrusted data.
- Capability inventory: The skill has access to network tools (
curl,requests,fetch) and file system access for reading/writing configuration files. - Sanitization: There are no specific instructions to validate or sanitize the external documentation before processing its content for parameter definitions.
Audit Metadata