recraft
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external image URLs provided by the user as input for generation and editing tasks. * Ingestion points: User-supplied image URLs and base64 data strings referenced in SKILL.md. * Boundary markers: None present. * Capability inventory: The skill performs network POST requests to gateway.pixazo.ai. * Sanitization: None present.
- [COMMAND_EXECUTION]: The skill utilizes shell commands for managing API credentials and providing usage examples. * Evidence: Instructions to use chmod 600 for securing the local ~/.pixazo/api-key file. * Evidence: curl command templates provided for manual API interaction.
- [EXTERNAL_DOWNLOADS]: The skill suggests the installation of further capabilities from the vendor's repository. * Evidence: Recommends using npx skills add for the Pixazo-AI/skills repository.
Audit Metadata