nucleus
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches model schemas and parameter references from the vendor's official domain at
https://www.pixazo.ai/models/nucleus.mdto ensure correct API usage. - [COMMAND_EXECUTION]: Provides instructions for the agent to install related vendor skills using the
npx skillscommand pointing to thePixazo-AI/skillsrepository. - [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface as it processes user-supplied prompts and external documentation to formulate API requests.
- Ingestion points: User text prompts, reference image URLs/Base64 data, and the external model documentation file (
nucleus.md). - Boundary markers: Not explicitly defined in the prompt construction scripts.
- Capability inventory: Execution of HTTP POST requests via
curl, Python'srequestslibrary, and Node.jsfetchAPI. - Sanitization: No specific escaping or validation logic is provided for the user-supplied prompt string before it is included in the JSON payload.
- Ingestion points: User text prompts, reference image URLs/Base64 data, and the external model documentation file (
Audit Metadata