skills/pixazo-ai/skills/nucleus/Gen Agent Trust Hub

nucleus

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches model schemas and parameter references from the vendor's official domain at https://www.pixazo.ai/models/nucleus.md to ensure correct API usage.
  • [COMMAND_EXECUTION]: Provides instructions for the agent to install related vendor skills using the npx skills command pointing to the Pixazo-AI/skills repository.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface as it processes user-supplied prompts and external documentation to formulate API requests.
    • Ingestion points: User text prompts, reference image URLs/Base64 data, and the external model documentation file (nucleus.md).
    • Boundary markers: Not explicitly defined in the prompt construction scripts.
    • Capability inventory: Execution of HTTP POST requests via curl, Python's requests library, and Node.js fetch API.
    • Sanitization: No specific escaping or validation logic is provided for the user-supplied prompt string before it is included in the JSON payload.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 09:01 PM