Skills pexoai-agent

📦

pexoai-agent

Name: pexoai-agent
Author: pexoai

v0.3.11 Content revision r1 High Risk 🌐 Network access📁 Filesystem access🔑 Env variables⚙️ External commands

Create AI Videos With Pexo

AI video production needs model selection, uploads, polling, and delivery steps. This skill guides agents through Pexo project creation, asset upload, chat, status polling, and final video delivery.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "pexoai-agent" from https://skillstore.io/skills/pexoai-pexoai-agent.md and its manifest at https://skillstore.io/api/skills/pexoai-pexoai-agent/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/pexoai-pexoai-agent.md Signed manifest GET /api/skills/pexoai-pexoai-agent/manifest Signed lockfile GET /api/skills/pexoai-pexoai-agent/lockfile

Test it

Using "pexoai-agent". Create a 15 second product ad from this shoe photo.

Expected outcome:

The request was submitted to Pexo with the uploaded image attached. The agent gives the project page, waits, then returns preview or final video links.

Using "pexoai-agent". The preview looks too slow. Make it faster and keep the same product.

Expected outcome:

The revision feedback is sent to the same Pexo project. The agent resumes polling and reports the next preview or final delivery.

Using "pexoai-agent". Download the finished video for my project.

Expected outcome:

The agent retrieves the final asset, downloads it to the local Pexo cache, and shares the full signed video URL.

Security Audit

High Risk

v59 • 7/6/2026 Open versioned report

Most static findings are expected for a shell-based Pexo API client and were dismissed where they are documentation-only, safely quoted helper commands, secure temp files, or masked diagnostics. Confirmed risks remain around credential transmission, local file upload to an external service, shell-sourced config, and prompt instruction priority claims.

Files scanned

2,153

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:78-80

Prompt Injection Attempt Detected

SKILL.md labels a language rule as "highest priority" and says "You MUST reply ... non-negotiable." This attempts to set instruction priority inside marketplace content and may conflict with platform instructions.

The text explicitly claims priority and uses mandatory language. It does not request credential theft or audit bypass, so severity is high rather than critical.

Medium

scripts/_common.sh:7-8 scripts/pexo-doctor.sh:76

Shell-Sourced Configuration File

The shared helper sources the Pexo config file as shell code. A modified config file can execute arbitrary shell commands when any wrapper script loads it.

The files directly use source on the config path. This is a common convenience pattern, but it creates a real code execution risk if the config file is not trusted.

Medium

scripts/pexo-upload.sh:71-84 SKILL.md:296-303

Local File Upload To External Service

The upload workflow accepts a local file path and sends that file to Pexo storage. This is required for media generation, but sensitive local files could be disclosed if the agent supplies the wrong path.

The script obtains upload credentials and then uses curl --data-binary on the caller-provided path. The behavior is intentional and documented, so it is a privacy risk rather than hidden exfiltration.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/_common.sh:33

Generic API/secret keys

printf 'Authorization: Bearer %s' "$PEXO_API_KEY"

Constructs an Authorization bearer header directly from PEXO_API_KEY. This is required for the API client but is a real credential exposure path if the endpoint is changed or misused.

High

scripts/pexo-doctor.sh:147

Generic API/secret keys

-H "Authorization: Bearer $PEXO_API_KEY" \

Sends PEXO_API_KEY in an Authorization header during API validation. The check is expected, but it transmits a secret to the configured service.

Medium

scripts/pexo-upload.sh:83-84

Shell command substitution

http_code=$(curl -sS -X PUT -H "Content-Type: $mime_type" \

Runs curl to upload the caller-provided local file to a signed URL returned by Pexo. This is intended behavior, but it can disclose local files if invoked on sensitive paths.

Medium

scripts/pexo-upload.sh:84

Standard device file access

--data-binary "@$filepath" -o /dev/null -w '%{http_code}' "$upload_url" 2>/dev/null || echo "000")

Uses curl with --data-binary on the caller-provided file path, which reads local file content for upload. This is expected for media upload, but it is a real data disclosure capability.

Risk Factors

🌐 Network access (21)

📁 Filesystem access (74)

🔑 Env variables (23)

⚙️ External commands (130)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/pexoai-pexoai-agent/audits/59?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/pexoai-pexoai-agent/security.svg)](https://skillstore.io/skills/pexoai-pexoai-agent?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/pexoai-pexoai-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/pexoai-pexoai-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/pexoai-pexoai-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

pexoai. (2026). pexoai-agent security audit report (audit version 59) [Author version 0.3.11]. Skillstore. https://skillstore.io/skills/pexoai-pexoai-agent/audits/59

BibTeX citation

@techreport{pexoai-pexoai-pexoai-agent-2026,
  author = {pexoai},
  title = {pexoai-agent security audit report (audit version 59)},
  institution = {Skillstore},
  year = {2026},
  number = {59},
  url = {https://skillstore.io/skills/pexoai-pexoai-agent/audits/59},
  note = {Author version 0.3.11}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pexoai-agent security audit report (audit version 59)"
version: "0.3.11"
type: report
authors:
  - name: "pexoai"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/pexoai-pexoai-agent/audits/59"
identifiers:
  - type: other
    value: "skillstore:pexoai-pexoai-agent:audit:59"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create Product Ads

Turn product photos, URLs, or short briefs into finished promotional videos.

Produce Social Shorts

Generate vertical clips for TikTok, Instagram Reels, or YouTube Shorts.

Scale Catalog Videos

Create repeated video assets from product media and consistent campaign instructions.

Try These Prompts

Make a Simple Video

Create a 15 second vertical video about my new product. Keep it clear, modern, and ready for social media.

Use a Reference Image

Use this uploaded product image as the main visual reference. Create a short product ad with clean lighting and a direct call to action.

Revise a Project

Revise the current video. Make the opening faster, keep the same product, and make the final message more direct.

Build Campaign Variants

Create three short video variants from these assets. Use one calm brand version, one fast social version, and one product feature version.

Best Practices

Confirm user intent before uploading local media to Pexo.
Run diagnostics before first use or after configuration errors.
Poll at 60 second intervals and avoid duplicate chat messages during WAIT.

Avoid

Do not upload unrelated local files or hidden configuration files.
Do not truncate signed video URLs when delivering final assets.
Do not send new chat messages while a project is still waiting.

Frequently Asked Questions

Does this skill require a Pexo account?

Yes. It requires a Pexo API key and a configured Pexo base URL.

Which agent tools can use it?

The report lists support for Claude, Codex, and Claude Code.

What inputs can it use?

It can work with text, images, videos, audio, scripts, and URLs that are converted into uploaded files.

Does it send data outside my machine?

Yes. It sends prompts and uploaded media to Pexo to generate videos.

How are insufficient credits handled?

The scripts report credit errors and provide a Pexo top-up path when possible.

What should I review before installing?

Review the shell scripts, external API use, API key handling, and local file upload behavior.

Developer Details

Author

pexoai

License

MIT

Author version

v0.3.11

Skillstore revision

Repository

https://github.com/pexoai/pexo-skills/tree/main/skills/pexo-agent/

Ref

e397ce5a135369cd6def89cb6400d013e2f68f2f

Maintenance freshness

7/18/2026

Usage

79 downloads · 383 views

File structure

📁 references/

📄 SETUP-CHECKLIST.md

📄 TROUBLESHOOTING.md

📁 scripts/

📄 _common.sh

📄 pexo-asset-get.sh

📄 pexo-chat.sh

📄 pexo-doctor.sh

📄 pexo-entitlements.sh

📄 pexo-project-create.sh

📄 pexo-project-get.sh

📄 pexo-project-list.sh

📄 pexo-upload.sh

📄 _meta.json

📄 SKILL.md