seed-audio
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions and code for the agent to execute API calls to
gateway.pixazo.aiusingcurl, Pythonrequests, and Node.jsfetch. - [CREDENTIALS_UNSAFE]: The skill manages a
PIXAZO_API_KEYby checking environment variables or a configuration file at~/.pixazo/api-key. It correctly instructs the agent to applychmod 600to the file to secure the credentials. - [EXTERNAL_DOWNLOADS]: The skill references documentation at
www.pixazo.aiand suggests a command to install further tools from the vendor's GitHub repository (Pixazo-AI/skills) usingnpx. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data which introduces a vulnerability surface. Ingestion points: User-provided
text_promptand API response URLs inSKILL.md. Boundary markers: None identified. Capability inventory: Network requests (curl, requests, fetch) and file writing to the user's home directory. Sanitization: None specified for the text inputs.
Audit Metadata