Skills pexo-agent

📦

pexo-agent

Name: pexo-agent
Author: pexoai

v0.3.11 Content revision r1 High Risk 🌐 Network access📁 Filesystem access🔑 Env variables⚙️ External commands

Create AI Videos with Pexo

Video production often requires model selection, media handling, and repeated status checks. This skill gives Claude, Codex, and Claude Code a guided workflow for Pexo projects, uploads, revisions, and delivery.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "pexo-agent" from https://skillstore.io/skills/pexoai-pexo-agent.md and its manifest at https://skillstore.io/api/skills/pexoai-pexo-agent/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/pexoai-pexo-agent.md Signed manifest GET /api/skills/pexoai-pexo-agent/manifest Signed lockfile GET /api/skills/pexoai-pexo-agent/lockfile

Test it

Using "pexo-agent". Create a 15-second vertical product ad from my uploaded shoe photo.

Expected outcome:

The assistant creates a Pexo project, uploads the image, submits the request, shares the project page, and returns preview options when ready.

Using "pexo-agent". Check why Pexo is not working on this machine.

Expected outcome:

The assistant reports whether the config file, API key, required tools, network access, and Pexo authentication check passed.

Using "pexo-agent". Deliver the final video for this project.

Expected outcome:

The assistant retrieves the final asset, downloads a local copy when available, shares the full signed download link, and asks whether revisions are needed.

Security Audit

High Risk

v4 • 7/6/2026 Open versioned report

The skill is an outbound Pexo API client that requires shell scripts, a PEXO_API_KEY, local media upload, project polling, and asset delivery. Most static command-substitution, documentation, and troubleshooting matches are safe in context, but sourcing ~/.pexo/config as shell, sending bearer credentials to a configurable endpoint, uploading user media, and sharing signed URLs remain material risks. No direct malware behavior was found in the reviewed files.

Files scanned

2,153

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (7)

High

SKILL.md:78-80

Prompt Injection Attempt Detected

SKILL.md declares a language rule as "highest priority" and "non-negotiable". This prompt-priority language can conflict with platform or system instructions, even though it focuses on response language rather than bypassing security review.

The suspicious priority wording is explicit in the skill instructions. Confidence is moderated because it does not directly instruct the agent to skip audits or reveal secrets.

High

scripts/_common.sh:7-8 scripts/pexo-doctor.sh:71-76

Untrusted Shell Config Sourcing

The scripts use the hidden Pexo config path and source it as shell. A compromised or loosely writable config file can run arbitrary commands whenever Pexo scripts start.

The code directly sources the config file after selecting a path from PEXO_CONFIG or $HOME/.pexo/config. This is a clear shell execution boundary, not only a hidden-file reference.

High

SKILL.md:296-303 scripts/pexo-upload.sh:82-84

User Media Upload To External Storage

The workflow instructs agents to upload user-provided media and the upload script sends local file bytes to a signed storage URL. This can disclose sensitive images, videos, or audio if consent and file selection are not controlled.

The documentation describes the upload workflow and the script performs curl --data-binary from the supplied file path. The data transfer is core functionality and clearly evidenced.

High

scripts/_common.sh:7-8 scripts/_common.sh:32-34 scripts/_common.sh:228-239

Configurable Endpoint Receives Bearer Token

The API base URL can come from config or environment, while the shared request helper attaches the Pexo API key as a bearer token. If the base URL is changed, credentials can be sent to an unintended endpoint.

The config is sourced, the Authorization header is generated from PEXO_API_KEY, and curl targets PEXO_BASE_URL plus the API path. The risk depends on endpoint integrity but the data flow is explicit.

Medium

scripts/pexo-chat.sh:130

System reconnaissance

body=$(jq -nc --arg pid "$pid" --arg msg "$msg" --arg ts "$ts" --arg ch "$choice" \

This JSON body carries the user-visible message to the external Pexo chat endpoint through the shared request helper. That is expected, but it exposes user prompts to the service.

Medium

scripts/pexo-chat.sh:133

System reconnaissance

body=$(jq -nc --arg pid "$pid" --arg msg "$msg" --arg ts "$ts" \

This JSON body carries the user-visible message to the external Pexo chat endpoint through the shared request helper. That is expected, but it exposes user prompts to the service.

Medium

SKILL.md:232-236

Signed Download URL Disclosure

The delivery instructions tell the assistant to send full signed asset URLs, including all query parameters. These URLs can grant temporary access to generated media and should be treated as bearer links.

The instruction explicitly requires sending complete signed URLs with query parameters. The URLs are expected for delivery, but they are access-bearing links.

Capability review items (38)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/_common.sh:228-232

Shell command substitution

http_code=$(curl -sS \

This curl invocation sends authenticated API requests to the configured PEXO_BASE_URL. The behavior is expected, but it creates a real credential and data exposure boundary.

High

scripts/_common.sh:241-245

Shell command substitution

http_code=$(curl -sS \

This curl invocation sends authenticated API requests to the configured PEXO_BASE_URL. The behavior is expected, but it creates a real credential and data exposure boundary.

High

scripts/_common.sh:339

Shell command substitution

-H "$(_pexo_auth_header)" \

This curl invocation sends authenticated API requests to the configured PEXO_BASE_URL. The behavior is expected, but it creates a real credential and data exposure boundary.

High

scripts/_common.sh:350

Shell command substitution

-H "$(_pexo_auth_header)" \

This curl invocation sends authenticated API requests to the configured PEXO_BASE_URL. The behavior is expected, but it creates a real credential and data exposure boundary.

High

scripts/_common.sh:3

Hidden file in home directory

# Sources ~/.pexo/config automatically; env vars override.

The shared script reads the default $HOME/.pexo/config path and sources that config as shell. A writable config file can execute arbitrary shell code when any Pexo script starts.

High

scripts/_common.sh:3

Hidden file access

# Sources ~/.pexo/config automatically; env vars override.

The shared script reads the default $HOME/.pexo/config path and sources that config as shell. A writable config file can execute arbitrary shell code when any Pexo script starts.

High

scripts/_common.sh:7

Hidden file access

_PEXO_CONFIG="${PEXO_CONFIG:-$HOME/.pexo/config}"

The shared script reads the default $HOME/.pexo/config path and sources that config as shell. A writable config file can execute arbitrary shell code when any Pexo script starts.

High

scripts/_common.sh:21

Generic API/secret keys

if [[ -z "${PEXO_API_KEY:-}" ]]; then

The script reads PEXO_API_KEY from the environment or sourced config. This is expected for the API client, but it places a bearer secret inside shell execution context.

High

scripts/_common.sh:22

Generic API/secret keys

missing+=("PEXO_API_KEY")

The script reads PEXO_API_KEY from the environment or sourced config. This is expected for the API client, but it places a bearer secret inside shell execution context.

High

scripts/_common.sh:33

Generic API/secret keys

printf 'Authorization: Bearer %s' "$PEXO_API_KEY"

The helper formats PEXO_API_KEY into an Authorization bearer header for network requests. If the configured endpoint is changed or the process is exposed, the API key can be leaked.

High

scripts/pexo-asset-get.sh:13

Hidden file in home directory

~/.pexo/tmp/ (or $PEXO_TMP_DIR when set) and returns both the signed URL and

The script documents downloading assets into ~/.pexo/tmp or PEXO_TMP_DIR. Generated videos can remain on disk and should be treated as sensitive media.

High

scripts/pexo-doctor.sh:145-151

Shell command substitution

http_code=$(curl -sS \

The diagnostic curl call reaches the configured Pexo base URL, and the API validation request includes authentication. This is expected but creates a credential and network exposure boundary.

High

scripts/pexo-doctor.sh:71

Hidden file access

config_path="${PEXO_CONFIG:-$HOME/.pexo/config}"

The diagnostic script reads a configurable hidden config path and sources it later. A modified config file can execute shell code during diagnostics.

High

scripts/pexo-doctor.sh:95

Generic API/secret keys

if [[ -n "${PEXO_API_KEY:-}" ]]; then