Audit History

Most static findings are expected for a shell-based Pexo API client and were dismissed where they are documentation-only, safely quoted helper commands, secure temp files, or masked diagnostics. Confirmed risks remain around credential transmission, local file upload to an external service, shell-sourced config, and prompt instruction priority claims.

Most static findings are expected for a shell-based Pexo API client and were dismissed where they are documentation-only, safely quoted helper commands, secure temp files, or masked diagnostics. Confirmed risks remain around credential transmission, local file upload to an external service, shell-sourced config, and prompt instruction priority claims.

The static alerts are partly true positives: the skill runs bash scripts, sources a user config file, sends bearer-token API calls, uploads local media, and downloads signed assets. Many command, weak-crypto, and Windows SAM alerts are false positives from documentation, markdown examples, or ordinary shell parsing. No confirmed malicious exfiltration was found, but publication should require manual review and clear user warnings.

This skill is a legitimate API client for the Pexo AI video generation service. It uses shell scripts to communicate with pexo.ai's REST API, requiring network access, API credentials, and local script execution. The static analyzer flagged a high number of findings (537) due to the combination of these risk factors, but most are expected patterns for a CLI API client. Key confirmed risks are: external API calls to a third-party service, credential access (PEXO_API_KEY), and local file operations. No evidence of malicious intent or obfuscation was found. The skill is safe to publish with MEDIUM risk level and appropriate user warnings.

Static analysis found 534 pattern matches across shell command execution, network calls, filesystem access, and env variable usage. All patterns are FALSE POSITIVES in context - they are legitimate operations for a shell-script-based video agent that wraps the Pexo API. The scripts execute curl commands to Pexo's official API endpoints, read a designated config file at ~/.pexo/config, and access required environment variables (PEXO_API_KEY, PEXO_BASE_URL). The associated heuristic detection of code-execution-plus-credential-access is expected behavior for an API-wrapping tool. The skill uses a mask_secret function to safely display API keys in diagnostic output. Risk level set to MEDIUM because the combination of external commands, network access, filesystem reads, and credential access creates a legitimate risk profile that users should understand, even though no malicious intent or data exfiltration patterns were detected.

Static analysis detected external commands, network, filesystem, and environment variable access across 13 files (2110 lines). After evaluation all findings are confirmed false positives for malicious intent. The skill legitimately uses shell scripts to call the Pexo video API, reads its own PEXO_API_KEY from environment variables, and accesses ~/.pexo/ for configuration and temp files. No obfuscation, data exfiltration, command injection, or prompt injection was found. Risk is MEDIUM because the skill requires elevated privileges (env access, network calls, shell execution) but these are used solely for legitimate video creation functionality.

All 534 static analysis findings are FALSE POSITIVES. This is a legitimate CLI tool that integrates with the Pexo AI video API. The external commands, network calls, filesystem access, and env var reads are all expected behaviors for a CLI tool that calls an authenticated REST API. No evidence of malicious intent, data exfiltration, credential theft, or obfuscation was found. The scripts are transparent, well-structured, and use safe coding patterns (set -euo pipefail, temp file cleanup, credential masking in output). Safe to publish with documentation about access patterns.

All 534 static analysis findings have been evaluated and are dismissed as false positives for this legitimate API client CLI tool. The external_commands findings (349) reflect standard shell script patterns in a bash-based CLI tool. The network findings (27) reference the legitimate pexo.ai API endpoints. The filesystem findings (79) access the intended ~/.pexo config directory and standard temp files. The env_access findings (25) read the intentionally required PEXO_API_KEY and PEXO_BASE_URL variables. No malicious intent, obfuscation, or prompt injection was detected. The combined capabilities warrant MEDIUM risk classification due to elevated operational risk, but the skill is safe to publish with appropriate warnings.