skills/pixazo-ai/skills/vidu/Gen Agent Trust Hub

vidu

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches supplemental model documentation and configuration from the vendor's official domain at https://www.pixazo.ai/models/vidu.md.
  • [COMMAND_EXECUTION]: The instructions include curl examples for API requests and reference an npx command for installing related skills from the vendor's repository.
  • [DATA_EXFILTRATION]: The skill reads from and writes to ~/.pixazo/api-key. This is identified as a standard local credential management practice for the Pixazo service and includes instructions to set restrictive file permissions (chmod 600).
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill processes user-provided video prompts and fetches remote markdown documentation from the vendor's website.
  • Boundary markers: No explicit delimiters are specified for the prompt data.
  • Capability inventory: The skill utilizes network operations (curl, Python requests, Node fetch) to communicate with the Pixazo API gateway.
  • Sanitization: No specific filtering or validation logic is defined for the input prompts or remote content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 09:01 PM