video-convert-api
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill manages user API keys by checking environment variables and a local file at
~/.pixazo/api-key. It correctly instructs the agent to save the key with restricted permissions (chmod 600), which is a security best practice for local storage. - [EXTERNAL_DOWNLOADS]: The skill is designed to fetch updated parameter schemas and documentation from
https://www.pixazo.ai/models/video-convert-api.md. As this domain belongs to the skill's author (pixazo-ai), it is considered a vendor-managed resource. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external documentation which could theoretically contain instructions.
- Ingestion points: Remote documentation fetch from
https://www.pixazo.ai/models/video-convert-api.md. - Boundary markers: None identified in the skill instructions.
- Capability inventory: Network requests via
curl,requests, andfetch; local file writing for API key persistence. - Sanitization: No specific content validation for the fetched markdown is described.
- [METADATA_POISONING]: The skill's frontmatter description field refers to image generation and editing, while the actual functionality and body instructions focus on video conversion. This discrepancy appears to be a documentation oversight.
Audit Metadata