video-to-previs

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill manages authentication by reading from and writing to ~/.pixazo/api-key. It instructs the agent to set file permissions to chmod 600, which is consistent with standard secret management practices for developer tools.
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to gateway.pixazo.ai to submit video processing tasks and retrieves updated documentation or instruction schemas from www.pixazo.ai. These resources are owned by the skill vendor.
  • [COMMAND_EXECUTION]: The skill includes instructions to use npx to manage other skills within the same vendor ecosystem and utilizes chmod to secure local credential files.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external instructions and parameter schemas from a remote URL to guide agent behavior during API calls.
  • Ingestion points: Fetches markdown instructions from https://www.pixazo.ai/models/video-to-previs.md to determine valid parameters and polling logic.
  • Boundary markers: None identified.
  • Capability inventory: File system writes (~/.pixazo/api-key) and network operations (cURL, Python requests, and Node.js fetch).
  • Sanitization: None identified.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 09:02 PM