The Agent Skills Directory

[SAFE]: The skill follows security best practices for credential management by instructing the agent to store the user's API key in a restricted local file (~/.pixazo/api-key) using chmod 600. This ensures the key is not hardcoded and remains inaccessible to other users on the system.
[INDIRECT_PROMPT_INJECTION]: The skill is instructed to fetch remote markdown documentation from https://www.pixazo.ai/models/stable-diffusion.md to determine exact API parameters at runtime. This creates a surface for indirect prompt injection where instructions embedded in the remote file could influence agent behavior, though the source is the vendor's own official domain.
Ingestion points: Instruction to fetch documentation from https://www.pixazo.ai/models/stable-diffusion.md located in SKILL.md.
Boundary markers: No specific delimiters or "ignore" instructions are provided for processing the remote content.
Capability inventory: The skill utilizes network requests (curl, requests, fetch), file system write access (for key storage), and shell command execution.
Sanitization: No explicit sanitization or validation of the remote markdown content is performed before processing.

stable-diffusion