The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill manages a Pixazo API key by checking environment variables, the current conversation history, and a local file at ~/.pixazo/api-key. It explicitly instructs the agent to save user-provided keys to this file using restricted permissions (chmod 600). The key is then transmitted to the vendor's API gateway at gateway.pixazo.ai.
[EXTERNAL_DOWNLOADS]: The skill fetches supplementary documentation, parameter references, and instruction sets from the remote URL https://www.pixazo.ai/models/video-merge-api.md.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands, including curl for API requests and npx for installing related tools from the Pixazo-AI/skills repository.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to fetch and follow instructions from a remote markdown file, creating an ingestion point for external content.
Ingestion points: https://www.pixazo.ai/models/video-merge-api.md (Reference section).
Boundary markers: None present in the skill body for remote content.
Capability inventory: Network requests to the vendor gateway and file system writes for credential management.
Sanitization: None specified.
[METADATA_POISONING]: There is a discrepancy between the skill's metadata and its technical body. The description claims the skill is for image generation and editing and should not trigger for video tasks, while the implementation instructions and API endpoints focus exclusively on merging video clips. This represents misleading documentation.

video-merge-api