video-audio-remover-api
Warn
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: MEDIUMMETADATA_POISONINGEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [METADATA_POISONING]: The skill exhibits significant internal contradictions between its metadata and implementation. The name
video-audio-remover-apiand the provided code snippets focus on video processing, yet the description and trigger logic claim the tool is for "Image generation/editing" and explicitly tell the agent not to trigger for video. This can lead to the agent misinterpreting its capabilities or attempting to use video-processing tools for image-related user requests. - [EXTERNAL_DOWNLOADS]: The skill is configured to fetch extended configuration and reference data from the vendor's official domain (
pixazo.ai). - [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect injection by instructing the agent to load and follow additional instructions from a remote URL at runtime.
- Ingestion points: Remote instruction file located at
https://www.pixazo.ai/models/video-audio-remover-api.md. - Boundary markers: No specific boundary markers or "ignore" instructions are provided for the remote content.
- Capability inventory: File system write access (
~/.pixazo/api-key), network requests (gateway.pixazo.ai), and shell command execution (curl). - Sanitization: The skill does not implement validation or sanitization for the remote instructions fetched.
- [COMMAND_EXECUTION]: The documentation references a setup command using
npxto install a suite of vendor-related tools.
Audit Metadata