{"data":{"skill":{"slug":"pexoai-pexoai-agent","name":"pexoai-agent","icon":"📦","repo":"https://github.com/pexoai/pexo-skills/tree/main/skills/pexo-agent/","status":"approved","author":"pexoai","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"967ef8e3-ec4e-42a9-96b0-83c96f73f767","skill_id":"e5465916-49d3-4bb4-92c4-48e0ba585be3","version":51,"content_hash":"730bd22874dae09961d6fbea445337d9","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Evaluated 534 static analysis findings across 13 files (2110 lines). All 349 external_command detections are false positives: standard bash $(...) substitutions in legitimate shell scripts and backtick code blocks in markdown documentation. All 27 network detections reference the documented pexo.ai API and service URLs. All 79 filesystem detections involve the expected config directory (~/.pexo/config) and temp storage (~/.pexo/tmp), both documented in the skill's setup guide. All 25 env_access detections reference PEXO_API_KEY and PEXO_BASE_URL, which are required and documented configuration variables. No prompt injection, data exfiltration, or malicious intent found. Risk level set to medium due to the inherent credential handling and network communication required by the skill's purpose — not due to confirmed threats.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"scripts/_common.sh","line_end":431,"line_start":1},{"file":"scripts/pexo-chat.sh","line_end":155,"line_start":1},{"file":"scripts/pexo-upload.sh","line_end":107,"line_start":1},{"file":"scripts/pexo-doctor.sh","line_end":201,"line_start":1},{"file":"scripts/pexo-project-create.sh","line_end":85,"line_start":1},{"file":"scripts/pexo-project-get.sh","line_end":178,"line_start":1},{"file":"scripts/pexo-project-list.sh","line_end":81,"line_start":1},{"file":"scripts/pexo-asset-get.sh","line_end":89,"line_start":1},{"file":"scripts/pexo-entitlements.sh","line_end":64,"line_start":1}]},{"factor":"network","evidence":[{"file":"scripts/_common.sh","line_end":251,"line_start":228},{"file":"scripts/_common.sh","line_end":302,"line_start":273},{"file":"scripts/pexo-chat.sh","line_end":142,"line_start":137},{"file":"scripts/pexo-upload.sh","line_end":89,"line_start":71},{"file":"scripts/pexo-doctor.sh","line_end":128,"line_start":128},{"file":"scripts/pexo-doctor.sh","line_end":151,"line_start":145},{"file":"SKILL.md","line_end":10,"line_start":9},{"file":"SKILL.md","line_end":139,"line_start":139}]},{"factor":"filesystem","evidence":[{"file":"scripts/_common.sh","line_end":8,"line_start":7},{"file":"scripts/_common.sh","line_end":39,"line_start":36},{"file":"scripts/_common.sh","line_end":225,"line_start":223},{"file":"scripts/pexo-doctor.sh","line_end":84,"line_start":71},{"file":"scripts/pexo-doctor.sh","line_end":144,"line_start":143},{"file":"scripts/pexo-upload.sh","line_end":55,"line_start":50},{"file":"scripts/pexo-asset-get.sh","line_end":13,"line_start":13}]},{"factor":"env_access","evidence":[{"file":"scripts/_common.sh","line_end":8,"line_start":7},{"file":"scripts/_common.sh","line_end":22,"line_start":17},{"file":"scripts/_common.sh","line_end":34,"line_start":32},{"file":"scripts/pexo-doctor.sh","line_end":106,"line_start":88},{"file":"SKILL.md","line_end":14,"line_start":13},{"file":"SKILL.md","line_end":37,"line_start":30}]},{"factor":"external_commands","evidence":[{"file":"scripts/_common.sh","line_end":271,"line_start":212},{"file":"scripts/_common.sh","line_end":391,"line_start":319},{"file":"scripts/pexo-chat.sh","line_end":142,"line_start":48},{"file":"scripts/pexo-upload.sh","line_end":89,"line_start":33},{"file":"scripts/pexo-doctor.sh","line_end":185,"line_start":84},{"file":"scripts/pexo-project-create.sh","line_end":76,"line_start":27},{"file":"scripts/pexo-project-get.sh","line_end":165,"line_start":49}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"API Key Stored in Plaintext Config File","locations":[{"file":"scripts/_common.sh","line_end":8,"line_start":7},{"file":"scripts/_common.sh","line_end":22,"line_start":21},{"file":"SKILL.md","line_end":35,"line_start":30}],"description":"The skill requires PEXO_API_KEY to be stored in ~/.pexo/config as plaintext. While this is standard practice for CLI tools, it means the API key is readable by any process with filesystem access. The skill documents this clearly and uses a standard Unix hidden directory convention. Confidence: 0.55 — moderate concern given this is expected CLI behavior, not a flaw in the skill design."},{"title":"Heuristic: Code Execution + Network + Credential Access Pattern","locations":[{"file":"scripts/_common.sh","line_end":271,"line_start":212},{"file":"scripts/pexo-chat.sh","line_end":142,"line_start":127},{"file":"scripts/pexo-upload.sh","line_end":89,"line_start":71}],"description":"The static analyzer flagged a dangerous combination of shell command execution, network requests, and credential access. After manual evaluation, this pattern is confirmed as TRUE POSITIVE at the pattern level but FALSE POSITIVE for malicious intent. The skill is an API client that must execute commands, make network calls, and use credentials by design. All three capabilities are documented and transparent. Confidence: 0.85 — the pattern exists but is inherent to any API CLI tool; no malicious use was found."}],"low_findings":[{"title":"Hardcoded URLs in Documentation","locations":[{"file":"SKILL.md","line_end":10,"line_start":9},{"file":"SKILL.md","line_end":200,"line_start":199},{"file":"references/SETUP-CHECKLIST.md","line_end":17,"line_start":12}],"description":"Multiple markdown documentation files and shell scripts contain hardcoded URLs to pexo.ai and github.com. All URLs are legitimate service endpoints and documentation links for the Pexo platform. Confidence: 0.95 — definitively false positive for malicious intent; these are the expected service URLs."},{"title":"Hidden Directory Usage for Config and Temp Storage","locations":[{"file":"scripts/_common.sh","line_end":8,"line_start":7},{"file":"scripts/_common.sh","line_end":39,"line_start":36},{"file":"scripts/pexo-doctor.sh","line_end":84,"line_start":71}],"description":"The skill uses ~/.pexo/ for configuration and temporary file storage. This follows the standard Unix convention for per-user application data. Both the config path and temp directory are documented in the setup checklist. Confidence: 0.95 — expected and documented behavior."},{"title":"Static Analyzer Over-Triggering on Markdown Code Blocks","locations":[{"file":"references/SETUP-CHECKLIST.md","line_end":91,"line_start":9},{"file":"references/TROUBLESHOOTING.md","line_end":288,"line_start":5}],"description":"The SETUP-CHECKLIST.md and TROUBLESHOOTING.md reference files contain extensive code examples in fenced markdown code blocks. The static analyzer flagged backtick characters and command patterns within these documentation examples as executable code. These are instructional examples, not live execution paths. Confidence: 0.98 — definitively false positive."}],"dangerous_patterns":[{"title":"Shell Command Substitution ($(...)) in Bash Scripts","locations":[{"file":"scripts/_common.sh","line_end":271,"line_start":212},{"file":"scripts/pexo-chat.sh","line_end":135,"line_start":127},{"file":"scripts/pexo-upload.sh","line_end":55,"line_start":52},{"file":"scripts/pexo-doctor.sh","line_end":153,"line_start":143}],"description":"All 10 shell scripts in the scripts/ directory use $(...) command substitution extensively for capturing output from curl, jq, date, basename, and other standard Unix utilities. After evaluation, all uses involve fixed command names with controlled arguments — no user input is directly interpolated into command strings. Arguments flow through jq's --arg for safe JSON construction and are validated before use. This pattern is the standard way to capture subprocess output in bash. Verdict: FALSE POSITIVE — safe usage pattern."},{"title":"Shell Backtick Execution in Markdown Code Examples","locations":[{"file":"SKILL.md","line_end":80,"line_start":30},{"file":"SKILL.md","line_end":277,"line_start":264},{"file":"SKILL.md","line_end":314,"line_start":307}],"description":"SKILL.md contains backtick characters within fenced code blocks that demonstrate shell script usage (e.g., `pexo-upload.sh proj_123 shoes.jpg`). The static analyzer flagged these as Ruby/shell backtick execution, but they appear inside markdown code blocks that are rendered as examples, not executed. SKILL.md is a documentation file read by the AI, not evaluated as a shell script. Verdict: FALSE POSITIVE — documentation code examples, not executable backticks."},{"title":"Weak Cryptographic Algorithm Detection in Shebang Guards","locations":[{"file":"SKILL.md","line_end":3,"line_start":1},{"file":"scripts/pexo-doctor.sh","line_end":17,"line_start":17},{"file":"scripts/pexo-chat.sh","line_end":10,"line_start":10}],"description":"The static analyzer flagged 'Weak cryptographic algorithm' at multiple locations including SKILL.md:3 and various scripts. The flagged pattern is the sha256 hash used in YAML frontmatter and bash version detection guards like [ -n \"${BASH_VERSION:-}\" ]. No actual cryptographic operations are performed by the skill's code. Verdict: FALSE POSITIVE — static analyzer misidentified YAML frontmatter and bash version checks as weak cryptography."},{"title":"Windows SAM Database Detection (False Positive)","locations":[{"file":"SKILL.md","line_end":43,"line_start":43}],"description":"The static analyzer flagged a CRITICAL finding for 'Windows SAM database' at SKILL.md:43. The line reads 'You MUST reply to the user in the SAME language they use.' The word 'SAME' was misidentified by the pattern matcher as referencing the Windows SAM registry hive. This is clearly a language instruction for the AI, not a Windows security reference. Verdict: FALSE POSITIVE — pattern matcher error on the word 'SAME'."}],"files_scanned":13,"total_lines":2110,"audit_model":"claude","audited_at":"2026-05-15T09:15:46.143+00:00","created_at":"2026-05-15T10:07:31.176192+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"low","confirmedFindingCount":1,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}