The Agent Skills Directory

[SAFE]: The skill manages a vendor-specific API key stored in a dedicated local directory (~/.pixazo/api-key) with restricted permissions (chmod 600) and transmits it to the vendor's official API gateway (gateway.pixazo.ai). This is standard behavior for an API-integrated skill provided by the vendor.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection through its ingestion of user-provided data and external documentation.
Ingestion points: The skill processes user-supplied text prompts, image URLs/Base64 data, and fetches a remote reference file from https://www.pixazo.ai/models/studio-ghibli.md.
Boundary markers: Absent; no specific delimiters are defined to separate untrusted content from agent instructions.
Capability inventory: The skill performs network operations via curl, requests, and fetch to communicate with the vendor's API, and interacts with the local file system to manage its credential file.
Sanitization: Absent; inputs and external reference content are used directly in API request construction without explicit sanitization steps.

studio-ghibli