z-image
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and reference images which are used to build API requests to the Z-Image service. 1. Ingestion points: User-provided text prompts and reference image data described in SKILL.md. 2. Boundary markers: No specific delimiters are defined in the request templates. 3. Capability inventory: Performs network requests to gateway.pixazo.ai using curl, requests, and fetch. 4. Sanitization: No input validation or sanitization of the user prompt is specified.
- [EXTERNAL_DOWNLOADS]: The skill is instructed to fetch extended documentation and parameter schemas from the vendor's official documentation site at https://www.pixazo.ai/models/z-image.md.
- [COMMAND_EXECUTION]: Instructions direct the agent to save API credentials to ~/.pixazo/api-key and apply chmod 600 to secure the file. It also mentions using npx to add related skills from the vendor's repository.
Audit Metadata