vibeo
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill manages a
PIXAZO_API_KEYto authenticate with the Pixazo gateway. It follows security best practices by instructing the agent to store this sensitive information in a hidden local file (~/.pixazo/api-key) with restricted permissions (chmod 600) to prevent unauthorized access by other local users. - [EXTERNAL_DOWNLOADS]: The skill dynamically fetches documentation and API reference material from the vendor's official website (
pixazo.ai). These downloads are used to determine correct API parameters and are sourced from the authorized vendor domain. - [COMMAND_EXECUTION]: The skill utilizes shell commands to manage file permissions and perform network operations via
curl. These operations are limited to the vendor's API gateway (gateway.pixazo.ai) and local configuration management. - [INDIRECT_PROMPT_INJECTION]: The skill features a data ingestion surface where the agent is instructed to fetch and process external markdown files from the vendor's domain to guide its behavior regarding API fields. The risk is mitigated by the fact that the source is the official vendor documentation.
Audit Metadata