Skills pexoai-agent
📦

pexoai-agent

Medium Risk ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Generate AI Videos with Auto Model Selection

Creating professional AI videos is complex - you need to choose the right model, write prompts, and manage the production pipeline. Pexo Agent handles all of this by automatically routing each shot to the best model and producing a finished multi-shot video with music, subtitles, and transitions from a simple description.

Supports: Claude Codex Code(CC)
⚠️ 67 Poor
1

Download the skill ZIP

2

Upload in Claude

Go to Settings → Capabilities → Skills → Upload skill

3

Toggle on and start using

Test it

Using "pexoai-agent". Make a 15-second vertical video for a coffee shop that shows pouring a latte, the shop interior, and a customer smiling. Use warm colors and soft background music.

Expected outcome:

A finished 15-second vertical (9:16) video with 3 shots: latte art being poured, cozy shop interior with warm lighting, and a customer enjoying coffee. Background music is soft acoustic. Professional transitions between shots. Subtitles appear at the bottom.

Using "pexoai-agent". Create a product showcase video using this photo of handmade candles [uploaded image].

Expected outcome:

A 15-second product video featuring the uploaded candle image with slow zoom effects. The video includes text overlay showing the product name, soft ambient music, and a call-to-action at the end. The aspect ratio is 1:1 square format.

Security Audit

Medium Risk
v56 • 5/27/2026

This skill is a legitimate API client for the Pexo AI video generation service. It uses shell scripts to communicate with pexo.ai's REST API, requiring network access, API credentials, and local script execution. The static analyzer flagged a high number of findings (537) due to the combination of these risk factors, but most are expected patterns for a CLI API client. Key confirmed risks are: external API calls to a third-party service, credential access (PEXO_API_KEY), and local file operations. No evidence of malicious intent or obfuscation was found. The skill is safe to publish with MEDIUM risk level and appropriate user warnings.

13
Files scanned
2,153
Lines analyzed
12
findings
56
Total audits

High Risk Issues (2)

API Credential Access via Environment Variable
The skill reads PEXO_API_KEY from ~/.pexo/config or environment variables and uses it in Authorization headers for all API calls. This is required for the skill to function but means the API key is accessible to the AI agent and any process that can read the config file or environment.
External Network Communication to Third-Party API
All shell scripts make HTTPS requests to pexo.ai API endpoints. The base URL is configurable via PEXO_BASE_URL. This is the core functionality of the skill but involves data leaving the user's environment.
Medium Risk Issues (3)
Shell Script Execution via Command Substitution
The skill uses shell command substitution ($(...)) extensively in bash scripts to call the Pexo API. This is the intended operation of the skill but means the AI agent executes arbitrary shell commands. Arguments are validated in some cases (file existence, asset ID format) but not universally sanitized.
Hidden File Access for Configuration
The skill reads configuration from ~/.pexo/config, a hidden file in the user's home directory. This is standard CLI tool behavior but grants filesystem access to credential-containing files. The config file stores the PEXO_API_KEY in plaintext.
Temporary File and Directory Operations
The skill creates temporary files using mktemp and stores downloaded assets in ~/.pexo/tmp/. These operations are standard for CLI tools but do involve writing to the filesystem.
Low Risk Issues (2)
Hardcoded URLs in Documentation and Scripts
Multiple hardcoded URLs reference pexo.ai domains. These are legitimate service endpoints being documented, not malicious exfiltration targets. The URLs point to the service API, help guides, and project pages.
Standard Device File Access in Scripts
Some scripts redirect output to /dev/null, which is a standard shell scripting pattern for suppressing output. This is not a security concern.

Risk Factors

⚡ Contains scripts (10)
⚙️ External commands (16)
🌐 Network access (12)
📁 Filesystem access (12)
🔑 Env variables (11)

Detected Patterns

Shell Command Substitution with Variable Interpolation
Audited by: claude View Audit History →

Quality Score

64
Architecture
100
Maintainability
87
Content
47
Community
26
Security
91
Spec Compliance

What You Can Build

Marketing Video Production

Create product videos, promotional clips, and brand videos from a product photo or URL. The AI handles scriptwriting, shot composition, music selection, and final assembly.

Social Media Content Creation

Generate TikTok, Instagram Reels, and YouTube Shorts from a simple text description. The skill auto-selects the correct aspect ratio and model for short-form video.

E-commerce Video at Scale

Produce multiple product video variants for A/B testing from product catalogs. Upload product images and let the agent create consistent branded video content.

Try These Prompts

Basic Text-to-Video
Make a 15-second promotional video about [your product or topic].
Video with Reference Image
[Upload a product photo] Create a product video for this item. The video should be 15 seconds long and focus on the product features.
Multi-Shot Brand Video
Create a 30-second brand video with 3 shots. The first shot shows the product packaging, the second shows the product in use, and the third shows the product with a call to action. Use upbeat music and add subtitles.
Video Revision with Feedback
Change the background music to something more energetic. Make the text captions larger and position them at the bottom center. Keep the same visuals.

Best Practices

  • Upload reference images or audio directly instead of providing web URLs - the skill cannot crawl web links
  • Describe your desired video output clearly including length, style, and target platform for best results
  • Check your Pexo credit balance before starting large projects to avoid mid-production interruptions

Avoid

  • Adding unnecessary creative details that override Pexo's professional video judgment - this produces lower quality videos
  • Calling pexo-chat.sh during the WAIT polling phase - this triggers duplicate video production
  • Truncating download URLs by removing query parameters - this causes 403 Forbidden errors on video links

Frequently Asked Questions

What is Pexo Agent?
Pexo Agent is an AI video generation skill for Claude Code. It acts as a bridge between you and the Pexo video generation API. You describe the video you want, and it handles all the technical steps automatically.
Do I need an API key to use this skill?
Yes, you need a Pexo API key. Sign up at pexo.ai, create an API key from your account settings, and save it to ~/.pexo/config. New users receive bonus credits upon registration.
How long does video generation take?
A typical 15-second, 3-shot video renders in about 8 minutes. A 60-second brand video takes approximately 20 minutes. The skill polls the server every 60 seconds and notifies you when the video is ready.
What video formats and aspect ratios are supported?
Videos can be 5 to 120 seconds long. Supported aspect ratios are 16:9 (landscape), 9:16 (portrait for TikTok and Reels), and 1:1 (square). The final output is an MP4 video file.
Can I revise a video after it has been generated?
Yes, you can send new instructions to the same project ID. The skill will submit your feedback to Pexo, which will generate a revised version of the video.
How do I check my credit balance?
Run the pexo-entitlements.sh script to see your available credits and plan details. The skill also automatically checks your credit balance when a 429 (credit exhausted) error occurs.