video-audio-remover-api

Warn

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: MEDIUMMETADATA_POISONINGEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [METADATA_POISONING]: The skill exhibits significant internal contradictions between its metadata and implementation. The name video-audio-remover-api and the provided code snippets focus on video processing, yet the description and trigger logic claim the tool is for "Image generation/editing" and explicitly tell the agent not to trigger for video. This can lead to the agent misinterpreting its capabilities or attempting to use video-processing tools for image-related user requests.
  • [EXTERNAL_DOWNLOADS]: The skill is configured to fetch extended configuration and reference data from the vendor's official domain (pixazo.ai).
  • [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect injection by instructing the agent to load and follow additional instructions from a remote URL at runtime.
  • Ingestion points: Remote instruction file located at https://www.pixazo.ai/models/video-audio-remover-api.md.
  • Boundary markers: No specific boundary markers or "ignore" instructions are provided for the remote content.
  • Capability inventory: File system write access (~/.pixazo/api-key), network requests (gateway.pixazo.ai), and shell command execution (curl).
  • Sanitization: The skill does not implement validation or sanitization for the remote instructions fetched.
  • [COMMAND_EXECUTION]: The documentation references a setup command using npx to install a suite of vendor-related tools.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 22, 2026, 09:02 PM