The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill manages API credentials by reading from the PIXAZO_API_KEY environment variable or a local file at ~/.pixazo/api-key. It provides instructions to save the user's key to this location using chmod 600 to restrict file permissions, which follows security best practices for local secret management.
[EXTERNAL_DOWNLOADS]: The skill references external resources from the vendor's domains (pixazo.ai) and provides a command (npx skills add Pixazo-AI/skills) to install additional skills from the vendor's GitHub repository. These resources are part of the vendor's ecosystem.
[COMMAND_EXECUTION]: The skill includes code snippets for curl, Python, and Node.js that demonstrate how to interact with the API. These are used for legitimate communication with the gateway.pixazo.ai endpoint.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided prompts and video URLs for conversion. It lacks explicit boundary markers or sanitization instructions for this input, which is a common attack surface for indirect prompt injection, though mitigated by the specific nature of the video processing task.
Ingestion points: User-provided descriptions (prompts), reference image URLs, and video URLs in SKILL.md.
Boundary markers: None identified in the provided instructions.
Capability inventory: Performs network operations via curl, Python requests, and Node.js fetch to external API endpoints.
Sanitization: No specific sanitization or validation of the user-provided URLs or prompts is mentioned.

video-gif-api