The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user content (prompts and image URLs) which is subsequently used to construct API requests to the Pixazo gateway.
Ingestion points: User-provided prompts and reference image URLs defined in the input handling section of SKILL.md.
Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore potentially malicious content embedded within the user data.
Capability inventory: The skill utilizes network capabilities to perform POST requests via curl, requests (Python), and fetch (Node.js).
Sanitization: There are no instructions for sanitizing or escaping user input before it is interpolated into the request body.
[COMMAND_EXECUTION]: The documentation includes instructions for the agent to execute shell commands such as chmod 600 to secure local files and npx for managing related vendor skills.
[EXTERNAL_DOWNLOADS]: The skill fetches supplemental model documentation and schemas from the vendor's official website at https://www.pixazo.ai/models/qwen-image.md to resolve parameter details at runtime.
[PERSISTENCE]: The skill implements a mechanism to persist the user's API key by saving it to ~/.pixazo/api-key, enabling the agent to reuse the credential in future sessions.

qwen-image