The Agent Skills Directory

[DATA_EXPOSURE]: The skill manages a vendor-specific API key by reading from and writing to a local configuration file at ~/.pixazo/api-key. It explicitly uses chmod 600 when saving the key, which is a security best practice for protecting sensitive files from other users on the system.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text to be processed by the text-to-speech API. This represents a potential surface for indirect injection into the synthesis engine, though the risk is limited to the resulting audio content and does not compromise the agent's execution environment.
[EXTERNAL_DOWNLOADS]: The skill instructions allow the agent to fetch extended model documentation and parameter references from the vendor's website (www.pixazo.ai). These operations are consistent with the skill's documented functionality.
[COMMAND_EXECUTION]: The skill provides code snippets for curl, Python, and Node.js to interact with the API. These are standard integration examples and do not perform unauthorized or hidden operations.

openbmb-voxcpm2