veed
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to fetch model parameters and schemas from a remote source at runtime.
- Ingestion points: The agent is directed to load documentation from
https://www.pixazo.ai/models/veed.mdto resolve API fields. - Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" warnings for the fetched content.
- Capability inventory: The skill utilizes network access (
curl,requests,fetch) and filesystem writes (~/.pixazo/api-key). - Sanitization: No explicit validation or filtering is applied to the remote documentation before processing.
- [COMMAND_EXECUTION]: The skill defines templates for shell, Python, and Node.js commands to interact with the Pixazo API gateway.
- Example scripts facilitate the primary purpose of video processing and background removal.
- Security hardening is practiced by instructing the agent to set file permissions to
600for the local API key storage file.
Audit Metadata