skills/pixazo-ai/skills/omnihuman/Gen Agent Trust Hub

omnihuman

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to store a user-provided API key in ~/.pixazo/api-key and apply chmod 600 to the file. This is a recommended security practice to ensure that sensitive credentials are only readable by the owner.
  • [EXTERNAL_DOWNLOADS]: The agent is directed to fetch operational specifications and parameter schemas from the vendor's official domain at https://www.pixazo.ai/models/omnihuman.md. These resources are provided by the author of the skill to ensure compatibility with the API.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface where it reads external model specifications from a remote markdown file.
  • Ingestion points: External model configuration fetched from https://www.pixazo.ai/models/omnihuman.md.
  • Boundary markers: None explicitly defined in the fetch instructions.
  • Capability inventory: Network requests via curl, Python requests, and JavaScript fetch; file creation and permission modification (chmod) for the API key file.
  • Sanitization: No specific sanitization or filtering is described for the content retrieved from the model specification URL.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 09:01 PM