vidu
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches supplemental model documentation and configuration from the vendor's official domain at
https://www.pixazo.ai/models/vidu.md. - [COMMAND_EXECUTION]: The instructions include
curlexamples for API requests and reference annpxcommand for installing related skills from the vendor's repository. - [DATA_EXFILTRATION]: The skill reads from and writes to
~/.pixazo/api-key. This is identified as a standard local credential management practice for the Pixazo service and includes instructions to set restrictive file permissions (chmod 600). - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill processes user-provided video prompts and fetches remote markdown documentation from the vendor's website.
- Boundary markers: No explicit delimiters are specified for the prompt data.
- Capability inventory: The skill utilizes network operations (
curl, Pythonrequests, Nodefetch) to communicate with the Pixazo API gateway. - Sanitization: No specific filtering or validation logic is defined for the input prompts or remote content.
Audit Metadata