スキル pexo-agent
📦
pexo-agent
v0.3.11 コンテンツリビジョン r1 高リスク 🌐 ネットワークアクセス📁 ファイルシステムへのアクセス🔑 環境変数⚙️ 外部コマンド
PexoでAI動画を作成
動画制作では、モデル選択、メディアの取り扱い、繰り返しのステータス確認が必要になることがよくあります。このスキルは、Pexoのプロジェクト、アップロード、修正、納品について、Claude、Codex、Claude Codeにガイド付きワークフローを提供します。
対応: Claude Codex Code(CC)
インストール前に停止して確認を求めてください。
計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "pexo-agent" from https://skillstore.io/skills/pexoai-pexo-agent.md and its manifest at https://skillstore.io/api/skills/pexoai-pexo-agent/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「pexo-agent」を使用しています。 アップロードした靴の写真から15秒の縦型商品広告を作成してください。
期待される結果:
アシスタントはPexoプロジェクトを作成し、画像をアップロードし、リクエストを送信し、プロジェクトページを共有し、準備ができたらプレビューオプションを返します。
「pexo-agent」を使用しています。 このマシンでPexoが動作していない理由を確認してください。
期待される結果:
アシスタントは、設定ファイル、APIキー、必要なツール、ネットワークアクセス、Pexo認証チェックが成功したかどうかを報告します。
「pexo-agent」を使用しています。 このプロジェクトの最終動画を納品してください。
期待される結果:
アシスタントは最終アセットを取得し、利用可能な場合はローカルコピーをダウンロードし、署名付きダウンロードリンク全体を共有し、修正が必要かどうかを確認します。
セキュリティ監査
高リスクv4 • 2026/7/6 バージョン別レポートを開く
The skill is an outbound Pexo API client that requires shell scripts, a PEXO_API_KEY, local media upload, project polling, and asset delivery. Most static command-substitution, documentation, and troubleshooting matches are safe in context, but sourcing ~/.pexo/config as shell, sending bearer credentials to a configurable endpoint, uploading user media, and sharing signed URLs remain material risks. No direct malware behavior was found in the reviewed files.
13
スキャンされたファイル
2,153
解析済み行数
38
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (7)
高
Prompt Injection Attempt Detected
SKILL.md declares a language rule as "highest priority" and "non-negotiable". This prompt-priority language can conflict with platform or system instructions, even though it focuses on response language rather than bypassing security review.
The suspicious priority wording is explicit in the skill instructions. Confidence is moderated because it does not directly instruct the agent to skip audits or reveal secrets.
高
Untrusted Shell Config Sourcing
The scripts use the hidden Pexo config path and source it as shell. A compromised or loosely writable config file can run arbitrary commands whenever Pexo scripts start.
The code directly sources the config file after selecting a path from PEXO_CONFIG or $HOME/.pexo/config. This is a clear shell execution boundary, not only a hidden-file reference.
高
User Media Upload To External Storage
The workflow instructs agents to upload user-provided media and the upload script sends local file bytes to a signed storage URL. This can disclose sensitive images, videos, or audio if consent and file selection are not controlled.
The documentation describes the upload workflow and the script performs curl --data-binary from the supplied file path. The data transfer is core functionality and clearly evidenced.
高
Configurable Endpoint Receives Bearer Token
The API base URL can come from config or environment, while the shared request helper attaches the Pexo API key as a bearer token. If the base URL is changed, credentials can be sent to an unintended endpoint.
The config is sourced, the Authorization header is generated from PEXO_API_KEY, and curl targets PEXO_BASE_URL plus the API path. The risk depends on endpoint integrity but the data flow is explicit.
中
System reconnaissance
body=$(jq -nc --arg pid "$pid" --arg msg "$msg" --arg ts "$ts" --arg ch "$choice" \
This JSON body carries the user-visible message to the external Pexo chat endpoint through the shared request helper. That is expected, but it exposes user prompts to the service.
中
System reconnaissance
body=$(jq -nc --arg pid "$pid" --arg msg "$msg" --arg ts "$ts" \
This JSON body carries the user-visible message to the external Pexo chat endpoint through the shared request helper. That is expected, but it exposes user prompts to the service.
中
Signed Download URL Disclosure
The delivery instructions tell the assistant to send full signed asset URLs, including all query parameters. These URLs can grant temporary access to generated media and should be treated as bearer links.
The instruction explicitly requires sending complete signed URLs with query parameters. The URLs are expected for delivery, but they are access-bearing links.
機能レビュー項目 (38)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
高
Shell command substitution
http_code=$(curl -sS \
This curl invocation sends authenticated API requests to the configured PEXO_BASE_URL. The behavior is expected, but it creates a real credential and data exposure boundary.
高
Shell command substitution
http_code=$(curl -sS \
This curl invocation sends authenticated API requests to the configured PEXO_BASE_URL. The behavior is expected, but it creates a real credential and data exposure boundary.
高
Shell command substitution
-H "$(_pexo_auth_header)" \
This curl invocation sends authenticated API requests to the configured PEXO_BASE_URL. The behavior is expected, but it creates a real credential and data exposure boundary.
高
Shell command substitution
-H "$(_pexo_auth_header)" \
This curl invocation sends authenticated API requests to the configured PEXO_BASE_URL. The behavior is expected, but it creates a real credential and data exposure boundary.
高
Hidden file in home directory
# Sources ~/.pexo/config automatically; env vars override.
The shared script reads the default $HOME/.pexo/config path and sources that config as shell. A writable config file can execute arbitrary shell code when any Pexo script starts.
高
Hidden file access
# Sources ~/.pexo/config automatically; env vars override.
The shared script reads the default $HOME/.pexo/config path and sources that config as shell. A writable config file can execute arbitrary shell code when any Pexo script starts.
高
Hidden file access
_PEXO_CONFIG="${PEXO_CONFIG:-$HOME/.pexo/config}"
The shared script reads the default $HOME/.pexo/config path and sources that config as shell. A writable config file can execute arbitrary shell code when any Pexo script starts.
高
Generic API/secret keys
if [[ -z "${PEXO_API_KEY:-}" ]]; then
The script reads PEXO_API_KEY from the environment or sourced config. This is expected for the API client, but it places a bearer secret inside shell execution context.
高
Generic API/secret keys
missing+=("PEXO_API_KEY")
The script reads PEXO_API_KEY from the environment or sourced config. This is expected for the API client, but it places a bearer secret inside shell execution context.
高
Generic API/secret keys
printf 'Authorization: Bearer %s' "$PEXO_API_KEY"
The helper formats PEXO_API_KEY into an Authorization bearer header for network requests. If the configured endpoint is changed or the process is exposed, the API key can be leaked.
高
Hidden file in home directory
~/.pexo/tmp/ (or $PEXO_TMP_DIR when set) and returns both the signed URL and
The script documents downloading assets into ~/.pexo/tmp or PEXO_TMP_DIR. Generated videos can remain on disk and should be treated as sensitive media.
高
Shell command substitution
http_code=$(curl -sS \
The diagnostic curl call reaches the configured Pexo base URL, and the API validation request includes authentication. This is expected but creates a credential and network exposure boundary.
高
Hidden file access
config_path="${PEXO_CONFIG:-$HOME/.pexo/config}"
The diagnostic script reads a configurable hidden config path and sources it later. A modified config file can execute shell code during diagnostics.
高
Generic API/secret keys
if [[ -n "${PEXO_API_KEY:-}" ]]; then
The diagnostic script reads and partially handles PEXO_API_KEY, including masked display and preflight checks. This is expected, but it still processes a bearer secret in shell.
高
Generic API/secret keys
masked=$(mask_secret "$PEXO_API_KEY")
The diagnostic script reads and partially handles PEXO_API_KEY, including masked display and preflight checks. This is expected, but it still processes a bearer secret in shell.
高
Generic API/secret keys
echo "$PASS PEXO_API_KEY is set: $masked"
The diagnostic script reads and partially handles PEXO_API_KEY, including masked display and preflight checks. This is expected, but it still processes a bearer secret in shell.
高
Generic API/secret keys
if [[ "$PEXO_API_KEY" != sk-* ]]; then
The diagnostic script reads and partially handles PEXO_API_KEY, including masked display and preflight checks. This is expected, but it still processes a bearer secret in shell.
高
Generic API/secret keys
echo "$WARN PEXO_API_KEY does not start with sk-"
The diagnostic script reads and partially handles PEXO_API_KEY, including masked display and preflight checks. This is expected, but it still processes a bearer secret in shell.
高
Generic API/secret keys
if [[ -n "${PEXO_BASE_URL:-}" && -n "${PEXO_API_KEY:-}" ]]; then
The diagnostic script reads and partially handles PEXO_API_KEY, including masked display and preflight checks. This is expected, but it still processes a bearer secret in shell.
高
Generic API/secret keys
-H "Authorization: Bearer $PEXO_API_KEY" \
The diagnostic request sends PEXO_API_KEY in an Authorization bearer header. If PEXO_BASE_URL is changed or intercepted, the key can be exposed.
高
Shell command substitution
http_code=$(curl -sS -X PUT -H "Content-Type: $mime_type" \
The curl command uploads the user-selected file bytes to a signed storage URL. This is a real data transfer risk even though it is core functionality.
高
Standard device file access
--data-binary "@$filepath" -o /dev/null -w '%{http_code}' "$upload_url" 2>/dev/null || echo "000")
The script reads the local file path and sends its contents with curl --data-binary. Users must trust that the selected file is safe to disclose to Pexo storage.
中
Shell command substitution
entitlements=$(
The helper performs an additional authenticated entitlements request after credit errors. This exposes account metadata to the configured Pexo endpoint by design.
中
Hidden file access
local tmp_dir="${PEXO_TMP_DIR:-$HOME/.pexo/tmp}"
The shared helper uses a hidden home-directory temp path for downloaded/generated assets. This can retain sensitive media locally unless permissions and cleanup are controlled.
中
Shell command substitution
asset=$(pexo_get "/api/biz/projects/${pid}/assets/${aid}")
The script requests asset metadata from the Pexo API for a project and asset id. This is expected, but it retrieves remote project data over the network.
中
Shell command substitution
http_code=$(curl -sS -L \
The script follows a signed download URL and writes the asset locally. This is expected, but it trusts a remote URL and stores returned media on disk.
中
Hidden file access
~/.pexo/tmp/ (or $PEXO_TMP_DIR when set) and returns both the signed URL and
The script documents downloading assets into ~/.pexo/tmp or PEXO_TMP_DIR. Generated videos can remain on disk and should be treated as sensitive media.
中
Temp directory access
~/.pexo/tmp/ (or $PEXO_TMP_DIR when set) and returns both the signed URL and
The script documents downloading assets into ~/.pexo/tmp or PEXO_TMP_DIR. Generated videos can remain on disk and should be treated as sensitive media.
中
Shell command substitution
http_code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 10 "${PEXO_BASE_URL}" 2>/dev/nu
The diagnostic curl call reaches the configured Pexo base URL, and the API validation request includes authentication. This is expected but creates a credential and network exposure boundary.
中
Shell command substitution
result=$(pexo_get "/api/biz/auth/entitlements")
The script fetches account credit and plan entitlements through an authenticated Pexo API call. This exposes account metadata to the configured service endpoint.
中
Shell command substitution
result=$(pexo_post "/api/biz/projects" "$body") || {
The script sends the project name to the Pexo API to create a remote project. This is expected, but it transmits user-provided project metadata externally.
中
Shell command substitution
_raw=$(pexo_get "/api/biz/projects/${pid}")
The script performs authenticated project and history fetches from the Pexo API. This can expose project identifiers and retrieve user conversation history from the remote service.
中
Shell command substitution
history=$(pexo_get "/api/biz/projects/${pid}/history?page=1&page_size=200&sort_order=ASC")
The script performs authenticated project and history fetches from the Pexo API. This can expose project identifiers and retrieve user conversation history from the remote service.
中
Shell command substitution
resp=$(pexo_get "/api/biz/projects/${pid}/history?page=${page}&page_size=${page_size}&sort_order=DES
The script performs authenticated project and history fetches from the Pexo API. This can expose project identifiers and retrieve user conversation history from the remote service.
中
Shell command substitution
cred=$(pexo_post "/api/biz/projects/${pid}/assets/upload-credential" \
The script requests an upload credential for the selected local file from the Pexo API. This is intended behavior, but it transmits file metadata to the external service.
中
Hardcoded URL
https://pexo-assets.oss-us-east-1.aliyuncs.com/projects%2F123%2Fassets%2Fvideo.mp4?OSSAccessKeyId=xx
The documentation tells the assistant to send a complete signed asset URL, including query parameters that function as bearer access. The example is a placeholder, but the workflow encourages disclosure of sensitive download links.
低
Standard device file access
file --brief --mime-type "$1" 2>/dev/null || echo "application/octet-stream"
The file command reads a user-selected local file to determine MIME type before upload. This is expected, but it is still local file inspection.
低
Standard device file access
filesize=$(stat -f%z "$filepath" 2>/dev/null || stat -c%s "$filepath" 2>/dev/null)
The script reads local file metadata from the user-provided path before upload. This is expected, but it is still local file access.
リスク要因
🌐 ネットワークアクセス (21)
references/SETUP-CHECKLIST.md:12 references/SETUP-CHECKLIST.md:83 references/TROUBLESHOOTING.md:26 references/TROUBLESHOOTING.md:204 scripts/_common.sh:279 scripts/pexo-doctor.sh:81 scripts/pexo-doctor.sh:104 scripts/pexo-doctor.sh:164 scripts/pexo-entitlements.sh:49 SKILL.md:12 SKILL.md:13 SKILL.md:70 SKILL.md:136 SKILL.md:176 SKILL.md:189 SKILL.md:236 SKILL.md:237 SKILL.md:252 SKILL.md:262 SKILL.md:263 SKILL.md:280
📁 ファイルシステムへのアクセス (74)
references/SETUP-CHECKLIST.md:10 references/SETUP-CHECKLIST.md:11 references/SETUP-CHECKLIST.md:51 references/SETUP-CHECKLIST.md:55 references/SETUP-CHECKLIST.md:61 references/SETUP-CHECKLIST.md:87 references/SETUP-CHECKLIST.md:93 references/SETUP-CHECKLIST.md:10 references/SETUP-CHECKLIST.md:11 references/SETUP-CHECKLIST.md:51 references/SETUP-CHECKLIST.md:55 references/SETUP-CHECKLIST.md:61 references/SETUP-CHECKLIST.md:87 references/SETUP-CHECKLIST.md:93 references/TROUBLESHOOTING.md:36 references/TROUBLESHOOTING.md:37 references/TROUBLESHOOTING.md:181 references/TROUBLESHOOTING.md:185 references/TROUBLESHOOTING.md:191 references/TROUBLESHOOTING.md:272 references/TROUBLESHOOTING.md:36 references/TROUBLESHOOTING.md:37 references/TROUBLESHOOTING.md:181 references/TROUBLESHOOTING.md:185 references/TROUBLESHOOTING.md:191 references/TROUBLESHOOTING.md:272 references/TROUBLESHOOTING.md:181 references/TROUBLESHOOTING.md:185 references/TROUBLESHOOTING.md:272 scripts/_common.sh:3 scripts/_common.sh:3 scripts/_common.sh:7 scripts/_common.sh:37 scripts/_common.sh:44 scripts/_common.sh:74 scripts/_common.sh:263 scripts/_common.sh:284 scripts/_common.sh:285 scripts/_common.sh:292 scripts/_common.sh:363 scripts/_common.sh:407 scripts/_common.sh:223 scripts/_common.sh:224 scripts/_common.sh:225 scripts/_common.sh:329 scripts/_common.sh:330 scripts/_common.sh:331 scripts/pexo-asset-get.sh:13 scripts/pexo-asset-get.sh:13 scripts/pexo-asset-get.sh:13 scripts/pexo-asset-get.sh:61 scripts/pexo-doctor.sh:80 scripts/pexo-doctor.sh:71 scripts/pexo-doctor.sh:80 scripts/pexo-doctor.sh:32 scripts/pexo-doctor.sh:37 scripts/pexo-doctor.sh:111 scripts/pexo-doctor.sh:128 scripts/pexo-doctor.sh:143 scripts/pexo-doctor.sh:144 scripts/pexo-entitlements.sh:54 scripts/pexo-project-get.sh:111 scripts/pexo-project-get.sh:112 scripts/pexo-project-get.sh:145 scripts/pexo-project-get.sh:146 scripts/pexo-project-get.sh:147 scripts/pexo-project-get.sh:148 scripts/pexo-project-get.sh:156 scripts/pexo-project-get.sh:165 scripts/pexo-upload.sh:53 scripts/pexo-upload.sh:84 scripts/pexo-upload.sh:104 SKILL.md:67 SKILL.md:67
🔑 環境変数 (23)
references/SETUP-CHECKLIST.md:13 references/SETUP-CHECKLIST.md:34 references/SETUP-CHECKLIST.md:55 references/SETUP-CHECKLIST.md:92 references/TROUBLESHOOTING.md:18 references/TROUBLESHOOTING.md:36 references/TROUBLESHOOTING.md:191 references/TROUBLESHOOTING.md:288 scripts/_common.sh:21 scripts/_common.sh:22 scripts/_common.sh:33 scripts/pexo-doctor.sh:82 scripts/pexo-doctor.sh:95 scripts/pexo-doctor.sh:96 scripts/pexo-doctor.sh:97 scripts/pexo-doctor.sh:98 scripts/pexo-doctor.sh:99 scripts/pexo-doctor.sh:103 scripts/pexo-doctor.sh:142 scripts/pexo-doctor.sh:147 scripts/pexo-doctor.sh:161 SKILL.md:29 SKILL.md:71
⚙️ 外部コマンド (130)
scripts/_common.sh:223 scripts/_common.sh:224 scripts/_common.sh:225 scripts/_common.sh:228-232 scripts/_common.sh:241-245 scripts/_common.sh:254 scripts/_common.sh:258 scripts/_common.sh:264 scripts/_common.sh:282-286 scripts/_common.sh:291-292 scripts/_common.sh:329 scripts/_common.sh:330 scripts/_common.sh:331 scripts/_common.sh:339 scripts/_common.sh:350 scripts/_common.sh:358 scripts/_common.sh:359 scripts/_common.sh:360 scripts/_common.sh:364 scripts/_common.sh:370 scripts/_common.sh:383 scripts/_common.sh:396 scripts/_common.sh:414 scripts/pexo-asset-get.sh:29 scripts/pexo-asset-get.sh:46 scripts/pexo-asset-get.sh:47 scripts/pexo-asset-get.sh:54 scripts/pexo-asset-get.sh:55 scripts/pexo-asset-get.sh:58 scripts/pexo-asset-get.sh:61 scripts/pexo-asset-get.sh:65-70 scripts/pexo-asset-get.sh:73 scripts/pexo-asset-get.sh:79 scripts/pexo-chat.sh:48 scripts/pexo-chat.sh:69 scripts/pexo-chat.sh:70 scripts/pexo-chat.sh:76 scripts/pexo-chat.sh:127 scripts/pexo-chat.sh:130-131 scripts/pexo-chat.sh:133-134 scripts/pexo-doctor.sh:84 scripts/pexo-doctor.sh:92 scripts/pexo-doctor.sh:96 scripts/pexo-doctor.sh:105 scripts/pexo-doctor.sh:112 scripts/pexo-doctor.sh:121 scripts/pexo-doctor.sh:128 scripts/pexo-doctor.sh:134 scripts/pexo-doctor.sh:143 scripts/pexo-doctor.sh:144 scripts/pexo-doctor.sh:145-151 scripts/pexo-doctor.sh:152 scripts/pexo-doctor.sh:153 scripts/pexo-doctor.sh:159 scripts/pexo-doctor.sh:160 scripts/pexo-doctor.sh:165 scripts/pexo-doctor.sh:173 scripts/pexo-doctor.sh:177 scripts/pexo-doctor.sh:182 scripts/pexo-doctor.sh:185 scripts/pexo-entitlements.sh:47 scripts/pexo-entitlements.sh:51 scripts/pexo-entitlements.sh:53-54 scripts/pexo-project-create.sh:27 scripts/pexo-project-create.sh:71 scripts/pexo-project-create.sh:72 scripts/pexo-project-create.sh:76 scripts/pexo-project-get.sh:49 scripts/pexo-project-get.sh:99 scripts/pexo-project-get.sh:102 scripts/pexo-project-get.sh:103 scripts/pexo-project-get.sh:106 scripts/pexo-project-get.sh:110 scripts/pexo-project-get.sh:111 scripts/pexo-project-get.sh:112 scripts/pexo-project-get.sh:144 scripts/pexo-project-get.sh:145 scripts/pexo-project-get.sh:146 scripts/pexo-project-get.sh:147 scripts/pexo-project-get.sh:148 scripts/pexo-project-get.sh:150-152 scripts/pexo-project-get.sh:162 scripts/pexo-project-get.sh:165 scripts/pexo-project-list.sh:27 scripts/pexo-upload.sh:33 scripts/pexo-upload.sh:52 scripts/pexo-upload.sh:53 scripts/pexo-upload.sh:54 scripts/pexo-upload.sh:55 scripts/pexo-upload.sh:71-72 scripts/pexo-upload.sh:74 scripts/pexo-upload.sh:75 scripts/pexo-upload.sh:76 scripts/pexo-upload.sh:83-84 scripts/pexo-upload.sh:89-102 SKILL.md:67 SKILL.md:69-72 SKILL.md:72-74 SKILL.md:74 SKILL.md:94-95 SKILL.md:95-104 SKILL.md:104-106 SKILL.md:106-109 SKILL.md:109-111 SKILL.md:111-114 SKILL.md:114-117 SKILL.md:117-147 SKILL.md:147-266 SKILL.md:266-273 SKILL.md:273-284 SKILL.md:284-288 SKILL.md:288-292 SKILL.md:292-301 SKILL.md:301-307 SKILL.md:307-310 SKILL.md:310-314 SKILL.md:314-344 SKILL.md:344 SKILL.md:345 SKILL.md:346 SKILL.md:347 SKILL.md:348 SKILL.md:349 SKILL.md:350 SKILL.md:351-371 SKILL.md:371-372 SKILL.md:115 SKILL.md:303 SKILL.md:114-117 SKILL.md:301-307
検出されたパターン
System reconnaissance×2
監査者: codex 監査履歴を表示 →
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/pexoai-pexo-agent/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/pexoai-pexo-agent?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/pexoai-pexo-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/pexoai-pexo-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/pexoai-pexo-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
pexoai. (2026). pexo-agent security audit report (audit version 4) [Author version 0.3.11]. Skillstore. https://skillstore.io/skills/pexoai-pexo-agent/audits/4BibTeX形式の引用
@techreport{pexoai-pexoai-pexo-agent-2026,
author = {pexoai},
title = {pexo-agent security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/pexoai-pexo-agent/audits/4},
note = {Author version 0.3.11}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pexo-agent security audit report (audit version 4)"
version: "0.3.11"
type: report
authors:
- name: "pexoai"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/pexoai-pexo-agent/audits/4"
identifiers:
- type: other
value: "skillstore:pexoai-pexo-agent:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 64
アーキテクチャ
100
保守性
87
コンテンツ
67
コミュニティ
100
仕様準拠
作成できるもの
キャンペーン動画を制作する
キャンペーン概要から短いプロモーション動画を作成し、1つのプロジェクト内でプレビューと修正をまとめて管理します。
商品メディアを広告に変換する
商品写真やクリップをアップロードし、希望するメッセージを送信して、完成した動画アセットを受け取ります。
ソーシャル動画のドラフトを管理する
縦型動画を作成し、制作ステータスをポーリングし、プレビューを確認し、Pexoチャットを通じて変更を依頼します。
これらのプロンプトを試す
シンプルな商品動画を作成する
新しいランニングシューズ用に15秒の縦型商品動画を作成してください。エネルギッシュでInstagram Reelsに適したものにしてください。
アップロードしたメディアを参考として使用する
アップロードした商品写真を主な参考として使用してください。快適性、耐久性、発売価格を強調する、クリーンな20秒の広告を作成してください。
プレビュー選択を修正する
プレビューBを選んでください。冒頭ショットを明るくし、画面上のテキストを短くし、音楽はアップテンポのままにしてください。
複数ショットのキャンペーン動画を調整する
4つのシーンで構成される60秒のブランド動画を作成してください: 課題、商品の登場、顧客の瞬間、行動喚起。モダンなスタイルを使用し、16:9と9:16での納品に備えてください。
ベストプラクティス
- 制作を開始する前に、アップロードされたファイルをPexoに送信できることを確認してください。
- APIキーは制限された設定ファイルまたは環境変数に保存してください。
- 推奨間隔でポーリングし、制作待ちの間は重複するチャットメッセージを避けてください。
回避
- 明示的な許可なしに、個人情報を含むメディアや規制対象のメディアをアップロードしないでください。
- 完全なAPIキーをチャット、ログ、共有ドキュメントに貼り付けないでください。
- プロジェクトがすでに動画を制作中の場合は、チャットリクエストを繰り返し送信しないでください。
よくある質問
このスキルはローカルで動画を作成しますか？
いいえ。リクエストとメディアをPexoに送信し、その後プロジェクトステータスと最終アセットを取得します。
どの認証情報が必要ですか？
スクリプトにはPEXO_API_KEYが必要です。PEXO_BASE_URLもPexo APIエンドポイントに使用されます。
ファイルをアップロードできますか？
はい。対応する画像、動画、音声ファイルをPexoプロジェクトにアップロードできます。
どのAIツールで使用できますか？
メタデータには、Claude、Codex、Claude Codeのサポートが記載されています。
インストール前にユーザーは何を確認すべきですか？
ユーザーは、アウトバウンドネットワークアクセス、APIキーの取り扱い、ローカル設定の読み込み、メディアアップロードの動作を確認する必要があります。
クレジットが不足している場合はどうなりますか？
スクリプトはクレジット不足の問題を報告し、可能な場合は権利情報を取得し、ユーザーにPexoクレジット購入手順を案内します。
開発者情報
作成者
pexoaiライセンス
MIT
作者バージョン
v0.3.11
Skillstore リビジョン
r1
参照
e397ce5a135369cd6def89cb6400d013e2f68f2f
メンテナンスの新しさ
2026/7/20
利用状況
2 ダウンロード · 0 閲覧