video-to-previs
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill manages authentication by reading from and writing to
~/.pixazo/api-key. It instructs the agent to set file permissions tochmod 600, which is consistent with standard secret management practices for developer tools. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to
gateway.pixazo.aito submit video processing tasks and retrieves updated documentation or instruction schemas fromwww.pixazo.ai. These resources are owned by the skill vendor. - [COMMAND_EXECUTION]: The skill includes instructions to use
npxto manage other skills within the same vendor ecosystem and utilizeschmodto secure local credential files. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external instructions and parameter schemas from a remote URL to guide agent behavior during API calls.
- Ingestion points: Fetches markdown instructions from
https://www.pixazo.ai/models/video-to-previs.mdto determine valid parameters and polling logic. - Boundary markers: None identified.
- Capability inventory: File system writes (
~/.pixazo/api-key) and network operations (cURL, Pythonrequests, and Node.jsfetch). - Sanitization: None identified.
Audit Metadata