Versioned security assessment

Report ID: SA-E397CE5A

7/6/2026, 9:04:27 PM

pexoai-agent security assessment v58

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
pexoai-agent
Version
v58
Maintainer
pexoai
Source
github.com/pexoai/pexo-skills/tree/main/skills/pexo-agent/
Coverage
13 Files scanned · 2,153 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

3 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are expected for a shell-based Pexo API client and were dismissed where they are documentation-only, safely quoted helper commands, secure temp files, or masked diagnostics. Confirmed risks remain around credential transmission, local file upload to an external service, shell-sourced config, and prompt instruction priority claims.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

13 Files scanned · 2,153 Lines analyzed

7 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 21 evidence locations

Filesystem access

May read or write local files.

Observed in 53 evidence locations

Env variables

May read values from the process environment.

Observed in 23 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 128 evidence locations

Capability review items (4)
High
scripts/_common.sh:33
Generic API/secret keys
printf 'Authorization: Bearer %s' "$PEXO_API_KEY"
Constructs an Authorization bearer header directly from PEXO_API_KEY. This is required for the API client but is a real credential exposure path if the endpoint is changed or misused.
High
scripts/pexo-doctor.sh:147
Generic API/secret keys
-H "Authorization: Bearer $PEXO_API_KEY" \
Sends PEXO_API_KEY in an Authorization header during API validation. The check is expected, but it transmits a secret to the configured service.
Medium
scripts/pexo-upload.sh:83-84
Shell command substitution
http_code=$(curl -sS -X PUT -H "Content-Type: $mime_type" \
Runs curl to upload the caller-provided local file to a signed URL returned by Pexo. This is intended behavior, but it can disclose local files if invoked on sensitive paths.
Medium
scripts/pexo-upload.sh:84
Standard device file access
--data-binary "@$filepath" -o /dev/null -w '%{http_code}' "$upload_url" 2>/dev/null || echo "000")
Uses curl with --data-binary on the caller-provided file path, which reads local file content for upload. This is expected for media upload, but it is a real data disclosure capability.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 High
SKILL.md:78-80
Prompt Injection Attempt Detected
SKILL.md labels a language rule as "highest priority" and says "You MUST reply ... non-negotiable." This attempts to set instruction priority inside marketplace content and may conflict with platform instructions.
The text explicitly claims priority and uses mandatory language. It does not request credential theft or audit bypass, so severity is high rather than critical.
RISK-002 Medium
scripts/_common.sh:7-8scripts/pexo-doctor.sh:76
Shell-Sourced Configuration File
The shared helper sources the Pexo config file as shell code. A modified config file can execute arbitrary shell commands when any wrapper script loads it.
The files directly use source on the config path. This is a common convenience pattern, but it creates a real code execution risk if the config file is not trusted.
RISK-003 Medium
scripts/pexo-upload.sh:71-84SKILL.md:296-303
Local File Upload To External Service
The upload workflow accepts a local file path and sends that file to Pexo storage. This is required for media generation, but sensitive local files could be disclosed if the agent supplies the wrong path.
The script obtains upload credentials and then uses curl --data-binary on the caller-provided path. The behavior is intentional and documented, so it is a privacy risk rather than hidden exfiltration.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Prompt instructions claim highest priority over agent behavior.
    Remove highest-priority and non-negotiable wording. Present same-language behavior as a normal skill preference that remains subordinate to platform policy.
  2. FIX-002
    High
    API keys are transmitted to the configured base URL.
    Pin the default base URL to trusted Pexo domains, warn before custom base URLs, and continue masking API keys in diagnostics.
  3. FIX-003
    Medium
    Configuration files are sourced as shell code.
    Parse KEY=VALUE pairs without source, validate expected variable names, and recommend restrictive permissions on the config file.
  4. FIX-004
    Medium
    Local files can be uploaded to Pexo storage.
    Require explicit user intent before upload and reject hidden, config, or system paths unless the user specifically confirms them.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable