runway
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill instructions direct the agent to retrieve and store the
PIXAZO_API_KEY. It looks for the key in environment variables or the local file~/.pixazo/api-key. If found, it saves the key with restrictive permissions (chmod 600) in the user's home directory. This is standard practice for local credential management. - [EXTERNAL_DOWNLOADS]: The skill fetches model schemas and detailed parameter information from the vendor's official documentation at
https://www.pixazo.ai/models/runway.mdto ensure correct API interactions. - [COMMAND_EXECUTION]: The documentation references an
npxcommand for installing additional skills from thePixazo-AI/skillsrepository. This is a standard installation method for vendor-provided extensions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external content from the vendor's model documentation site. While this content influences how the agent structures API calls, the data is retrieved from the vendor's own infrastructure.
- Ingestion points: External model reference documentation fetched from
https://www.pixazo.ai/models/runway.md(SKILL.md). - Boundary markers: None specified for the external documentation content.
- Capability inventory: Performs network requests via
curl, Pythonrequests, and Node.jsfetchtogateway.pixazo.ai(SKILL.md). - Sanitization: Not explicitly defined for the fetched documentation content.
Audit Metadata