Audit History

This is a legitimate video generation skill using shell scripts to interact with the Pexo AI video API. All static findings are false positives or standard API tool patterns. Shell script execution is expected for CLI-based API tools. Network calls go to the legitimate Pexo service (pexo.ai). Environment variable access (PEXO_API_KEY, PEXO_BASE_URL) is required for API authentication. No malicious intent detected.

All static findings evaluated as false positives. The skill makes legitimate API calls to Pexo service (https://pexo.ai) for video generation. Backtick commands in documentation are examples, not executable code. Config file access is for user-provided API credentials. Network calls are restricted to known Pexo endpoints. No credential exfiltration or malicious behavior detected.

The static analyzer flagged 534 potential security issues, but after semantic evaluation, all findings are FALSE POSITIVES. The skill is a legitimate API integration for video creation. It uses shell scripts for API communication with the pexo.ai service. Shell command patterns flagged in markdown files are documentation of script usage, not code execution vulnerabilities. Network access is limited to the official pexo.ai API endpoint. Environment variable access (PEXO_API_KEY) is standard API authentication, not credential harvesting. Filesystem access uses standard config directories (~/.pexo/). No malicious behavior or data exfiltration detected.

Evaluated 534 static findings across 13 files (2110 lines). All patterns are legitimate CLI tool usage patterns. The skill is a wrapper for the Pexo AI video generation API that uses shell scripts for API communication. Shell command substitution in scripts (curl, jq) is standard CLI practice. API key access is limited to authentication with pexo.ai. No evidence of credential exfiltration or malicious intent. Documentation files contain example commands shown to users, not actual execution.

This is a legitimate video generation API client for pexo.ai. Static analysis detected 534 potential issues, but evaluation reveals these are mostly documentation examples (showing users what commands to run) and standard shell scripting patterns for API operations. The skill makes network calls only to pexo.ai, uses environment variables only for its own API credentials (PEXO_API_KEY), and performs standard file operations for configuration and asset uploads. No malicious behavior, data exfiltration, or command injection vulnerabilities were found. All findings are consistent with expected behavior for a video API client tool.

Evaluated 534 static findings across 13 files. External command patterns are standard shell scripting for API operations. Network calls go only to pexo.ai. Hidden file access is for user config storage (~/.pexo/config). No credential exfiltration or malicious intent detected. Risk factors are expected for an API client skill.

Evaluated 534 static security detections across 13 files. All findings are legitimate API client patterns. External commands are standard shell scripting for CLI tool integration. Network access is limited to Pexo API (https://pexo.ai). Environment and file access is for configuration and asset handling. The critical heuristic warning (code execution + network + credentials) is a false positive - this is a normal API client pattern. No malicious behavior detected.

This is a legitimate video generation API client for Pexo AI. Static analysis flagged 534 potential issues, but evaluation reveals these are primarily false positives. Shell commands are standard API operations (curl, jq). File access is limited to user-provided assets and standard config locations. No evidence of malicious intent, data exfiltration, or code injection. The skill follows safe patterns for API client implementations.

All static findings are false positives from documentation and shell scripts. The skill uses legitimate bash commands for API calls to a known video service (pexo.ai). External commands execute standard tools (curl, jq) with hardcoded arguments - no user input injection. Environment variables access only reads configuration (API keys) for the service. File operations are limited to config directories in user home. This is a legitimate client library for video creation, not malware.

Static analysis detected 534 patterns across 13 files, all evaluated as false positives. The skill is a legitimate video production API client that uses standard bash tooling (curl, jq) to communicate with Pexo.ai services. External commands are network requests to authenticated API endpoints. Filesystem access is limited to config storage and temp files. Environment variable access is for API key storage. No malicious intent or security risks identified.

Evaluated 534 static patterns across 13 files. All findings are false positives from a legitimate video production API client. The CRITICAL 'Windows SAM database' alert triggered on the word 'SAME' in SKILL.md:43 (a language instruction). Obfuscation heuristics fired due to the expected combination of network, filesystem, and credential access in a CLI tool. Shell scripts use standard command substitution for curl, jq, and mktemp. They read documented API keys from ~/.pexo/config, make HTTPS calls to pexo.ai, and access temp directories for uploads. No malicious intent, data exfiltration, or injection vulnerabilities found.

Static analysis detected 534 patterns across shell scripts and documentation. After manual review, all findings are FALSE POSITIVES. Shell command patterns are legitimate API operations to pexo.ai service. Environment variables access standard config files for API keys. Documentation files contain instructional examples. No malicious intent or security vulnerabilities confirmed.

The pexoai-agent skill is a legitimate video production integration tool. It executes shell scripts to interact with the Pexo AI video generation API. The static analyzer flagged numerous patterns (external commands, network access, environment variables) but these are all expected behavior for an API integration skill. The 'CRITICAL' heuristic warnings (Windows SAM database, dangerous combination) are false positives. No malicious intent was confirmed after evaluating the codebase semantics.

Security evaluation confirms this is a legitimate video production API integration skill. The static analyzer flagged 534 potential issues, but evaluation reveals these are false positives. The skill uses standard shell scripting for API communication with pexo.ai. All network requests target the verified pexo.ai endpoint. No evidence of credential exfiltration or malicious code. The CRITICAL "Windows SAM database" flag is a false positive (scanner detected "SAME" substring in "SAME language"). The high volume of external_commands flags is expected for an API client tool. Publishing is safe with appropriate documentation.

Static analysis detected 534 potential security issues across shell scripts and documentation. After manual review, all findings are false positives from legitimate functionality: shell command examples in documentation (SETUP-CHECKLIST.md, TROUBLESHOOTING.md), standard API operations using curl/jq, config file access (~/.pexo/config) for credential storage, and network requests to official Pexo.ai endpoints. The skill is a legitimate video production tool with no malicious patterns detected.

Static analysis flagged 534 patterns across 13 files, yielding a risk score of 100/100. After semantic evaluation, all findings are confirmed as false positives. The skill is a legitimate API client for the Pexo video platform. Shell command substitution patterns are standard bash scripting for API interaction. Network URLs all point to pexo.ai (the documented service). Filesystem access targets ~/.pexo/config (the documented configuration path). Environment variable access reads user-provided PEXO_API_KEY and PEXO_BASE_URL for authentication. No prompt injection, data exfiltration, or malicious intent was detected. The only risk is plaintext storage of API credentials in a local config file, which is standard practice for this type of tool.

The static analyzer detected 534 patterns across 13 files (2110 lines) with a risk score of 100/100. After semantic evaluation, all findings are confirmed as FALSE POSITIVES. The skill is a legitimate CLI client for the Pexo AI video platform. Shell commands (curl, jq, mktemp, stat) are standard CLI tooling. Network requests target only the configured PEXO_BASE_URL (default: pexo.ai). File access is limited to the skill's own config directory (~/.pexo/config) and temp files. Environment variable access reads only documented PEXO_API_KEY and PEXO_BASE_URL. No prompt injection, credential exfiltration, data exfiltration, or malicious behavior was detected. The skill acts as a relay between the user and Pexo's backend API.

This skill is an API client for the Pexo AI video platform. Static analysis detected 534 potential security patterns across 13 files, but the majority are false positives reflecting standard CLI tool behavior. The skill uses shell scripts to make authenticated HTTP requests, read local configuration, and manage temporary files. Detected patterns (external commands, network calls, filesystem access, environment variable reads) are all expected for an API client skill. Weak cryptographic algorithms (MD5/SHA1) are used for file checksums, which is low-risk in this context. No credential exfiltration, unauthorized network access, or malicious patterns were found after manual evaluation.

This skill is a legitimate AI video production CLI tool that interacts with the Pexo API. The static analyzer flagged 534 patterns across 13 files, but most are false positives from standard shell scripting conventions. All network requests target the declared Pexo API endpoint (pexo.ai). Shell commands use safe argument construction via jq --arg (no injection vectors). The credential handling follows standard API key patterns. No malicious behavior, data exfiltration, or unauthorized access was found. Users should be aware the skill requires network access to an external API, stores API keys in a local config file, and executes shell scripts.

Static analysis flagged 534 patterns across 13 files, but evaluation confirms these are FALSE POSITIVES. The skill is a legitimate CLI tool for the Pexo AI video platform. Shell command substitution patterns are standard bash scripting for API calls to pexo.ai. Environment variable access (PEXO_API_KEY, PEXO_BASE_URL) is documented authentication. Filesystem access targets the skill's own config directory (~/.pexo/). Network calls go exclusively to the official Pexo API. No malicious patterns, credential exfiltration, or command injection vectors detected.