skills/pixazo-ai/skills/runway/Gen Agent Trust Hub

runway

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXPOSURE]: The skill instructions direct the agent to retrieve and store the PIXAZO_API_KEY. It looks for the key in environment variables or the local file ~/.pixazo/api-key. If found, it saves the key with restrictive permissions (chmod 600) in the user's home directory. This is standard practice for local credential management.
  • [EXTERNAL_DOWNLOADS]: The skill fetches model schemas and detailed parameter information from the vendor's official documentation at https://www.pixazo.ai/models/runway.md to ensure correct API interactions.
  • [COMMAND_EXECUTION]: The documentation references an npx command for installing additional skills from the Pixazo-AI/skills repository. This is a standard installation method for vendor-provided extensions.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external content from the vendor's model documentation site. While this content influences how the agent structures API calls, the data is retrieved from the vendor's own infrastructure.
  • Ingestion points: External model reference documentation fetched from https://www.pixazo.ai/models/runway.md (SKILL.md).
  • Boundary markers: None specified for the external documentation content.
  • Capability inventory: Performs network requests via curl, Python requests, and Node.js fetch to gateway.pixazo.ai (SKILL.md).
  • Sanitization: Not explicitly defined for the fetched documentation content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 09:01 PM