pixverse
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlcommands to interact with the Pixazo API gateway endpoints for submitting video generation tasks. - [EXTERNAL_DOWNLOADS]: The instructions require the agent to fetch model-specific reference schemas and polling status details from
https://www.pixazo.ai/models/pixverse.md. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input (prompts and negative prompts) and interpolates them into API requests sent to external servers.
- Ingestion points: User-provided video descriptions and negative prompt parameters.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the interpolation templates.
- Capability inventory: The skill has network access (via
curl, Pythonrequests, and Node.jsfetch) and file system access (reading/writing~/.pixazo/api-key). - Sanitization: The instructions do not specify any validation or sanitization for the user-supplied content before it is processed.
Audit Metadata