T08 · Insecure Dependencies
Error
- Location
README.md:10- Finding
Unpinned Installation from Mutable Remote Sources
- Content
View full analysis
- Remediation
View remediation
Security audit
Founder Video
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a legitimate Pexo video wrapper, but its shell setup handles API credentials in ways that create review-worthy security risk.
Install only if you trust Pexo and are comfortable sending prompts, business details, and uploaded media to its hosted service. Use a narrowly scoped Pexo API key, store ~/.pexo/config with 600 permissions, avoid setting PEXO_BASE_URL away from https://pexo.ai unless you fully trust the endpoint, and inspect the exact installed commit rather than relying on an unpinned install command.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_common.sh:6- Finding
Configuration File Is Executed as Arbitrary Shell Code
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_common.sh:228- Finding
Bearer API Key and User Data Can Be Sent to an Unrestricted Configurable Endpoint
- Content
View full analysis
&2 printf 'Set them in %s or in the environment.\n' "$_PEXO_CONFIG" >&2 return 1 fi } _pexo_auth_header() { printf 'Authorization: Bearer %s' "$PEXO_API_KEY" } ``` Authenticated request construction: ```bash if [[ -n "$body" ]]; then http_code=$(curl -sS \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$_PEXO_REQUEST_TIMEOUT" \ -X "$method" \ -H "$(_pexo_auth_header)" \ -H "Content-Type: application/json" \ -D "$header_file" \ -o "$body_file" \ -w '%{http_code}' \ -d "$body" \ "$@" \ "${PEXO_BASE_URL}${path}" 2>"$err_file") || curl_status=$? else http_code=$(curl -sS \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$_PEXO_REQUEST_TIMEOUT" \ -X "$method" \ -H "$(_pexo_auth_header)" \ -H "Content-Type: application/json" \ -D "$header_file" \ -o "$body_file" \ -w '%{http_code}' \ "$@" \ "${PEXO_BASE_URL}${path}" 2>"$err_file") || curl_status=$? fi ``` ### Technical Analysis The scripts verify only that `PEXO_BASE_URL` is nonempty. They do not enforce HTTPS, verify that the destination host is `pexo.ai`, or otherwise bind the API credential to an approved origin. The API key is attached as a bearer token to requests made to the configured destination. The same request layer transmits project me ...[truncated 1499 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/SETUP-CHECKLIST.md:8- Finding
Plaintext API-Key File Is Created Without Restrictive Permissions
- Content
View full analysis
~/.pexo/config << 'EOF' PEXO_BASE_URL="https://pexo.ai" PEXO_API_KEY="sk-" EOF ``` ### Technical Analysis The documented setup stores the API key in plaintext but does not set restrictive permissions on either `~/.pexo` or `~/.pexo/config`. The resulting permissions depend on the user's current `umask`. In an environment with a permissive `umask`, the directory or file may be readable by other local users. The scripts also do not verify ownership or permission modes before reading the credential. ### Attack Path 1. A user follows the setup instructions in an environment with a permissive `umask`. 2. `~/.pexo/config` is created with group-readable or world-readable permissions. 3. Another local user or process reads the plaintext bearer key. 4. The attacker uses the key to make authenticated requests to Pexo. ### Impact Assessment The weakness can disclose the Pexo API key to other principals on the same host. A stolen key may permit unauthorized project access, generated-asset access, project creation, chat submission, and consumption of paid credits, depending on server-side authorization. The finding does not grant system-level privilege escalation by itself. Its scope is the Pexo account and any data or paid capabilities available through the exposed credential. ]]>- Remediation
View remediation
"$HOME/.pexo/config" <<'EOF' PEXO_BASE_URL="https://pexo.ai" PEXO_API_KEY="sk-" EOF chmod 600 "$HOME/.pexo/config" ``` Additionally: - Have each script verify that the configuration is owned by the current user. - Reject configuration files writable or readable by group or other users. - Reject symbolic links when loading credential files. - Prefer an operating-system credential store or secret manager where available. - Document key rotation and immediate revocation procedures for suspected exposure. ]]>
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/pexo-upload.sh:70- Finding
Upload Filename Is Embedded into JSON Without Encoding
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is for a high-level founder video creation workflow: taking narrative/site input and producing a completed publish-ready video. The supplied code does not implement script generation, shot generation, model selection, music selection, or video assembly. Instead, it performs a backend utility function for asset retrieval and downloading within Pexo. This is a materially different primary purpose and exposes undeclared capability to access and locally download project assets. While asset handling could be a supporting component of a larger video system, this code chunk by itself does not match the declared user-facing founder-video creation behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description promises a high-level founder-video generation workflow: provide story/product/pitch/site and Pexo writes the script, generates shots, picks models, and returns a finished video. The code shown does not implement that primary behavior. Instead, it is a low-level project chat submission utility for an already existing Pexo project. It validates message formatting for asset references, constructs a JSON request to /api/chat, waits for server acknowledgement, and returns submission metadata. This is materially narrower and operationally different from the declared end-user purpose, so the description does not accurately represent the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a founder-video creation workflow, but the code does not generate scripts, videos, shots, models, or music, and it accepts no founder-story/product input. Its primary purpose is instead operational diagnostics for a shell-based Pexo setup. While contacting Pexo services is related to the same vendor, the concrete behavior is materially different: setup validation and auth checking rather than media creation. The code also accesses local configuration files and validates API credentials, capabilities that are not reflected in the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill creates founder videos end-to-end. The supplied code does not generate scripts, shots, models, music, or any video asset. Its sole purpose is to query the authenticated user's entitlements and available credits, then optionally suggest purchasing more credits. That is a materially different primary purpose and involves access to account/plan data not disclosed by the description. Therefore the description does not accurately represent the code's behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a high-level content-generation skill that produces a complete founder video from user input. The supplied code chunk does not perform any of those functions. It only creates a new Pexo project by sending a project_name to /api/biz/projects and returning the projectId. This is a materially different primary purpose from founder video creation, and the code lacks any logic for ingesting story/product/site content or generating scripts, visuals, models, music, or a final video. Therefore the description does not accurately represent the behavior of this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description promises end-user creative generation of founder videos. The code chunk instead implements a backend status-inspection helper for an existing Pexo project. Its primary function is to read project metadata and message history, infer whether an agent should wait/respond/deliver/reconnect, and output normalized JSON. While this may support a larger founder-video workflow, the actual behavior in this chunk is not accurately represented by the declared description and introduces undeclared capabilities around project/history access and orchestration.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a content-generation workflow for producing founder videos from user-provided story or website input. The actual code does not create scripts, generate shots, pick models, compose music, or render videos. Instead, it performs a paginated API read to list projects for the authenticated user. This is a materially different primary purpose and an undeclared capability, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises an end-to-end founder video creation capability: taking narrative or website input and producing a completed founder video with music. The actual code does something much narrower and materially different: it uploads an existing local media file into a Pexo project via an upload-credential/upload/finalize flow. While asset upload could be a supporting part of a broader video pipeline, this code chunk by itself only provides generic media ingestion and lacks any logic for script generation, shot planning, model selection, music addition, or final video rendering. Therefore the code does not accurately represent the declared primary purpose.
- Content
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
md - `400`: the file was rejected — possible reasons: file exceeds the size limit, file format is not supported, or the file content does not match its extension. Convert or compress the file and re-upload from scratch using `pexo-upload.sh`. - `401`: auth failure — see Auth and Proxy Errors above. - `404`: the file record was not found. The upload session may have been cleaned up. Re-upload from scratch using `pexo-upload.sh`. - `412`: the upload session has already expired or been completed. Re-upload from scratch using `pexo-upload.sh`. - `500`: an unexpected server error occurred. Retry in a moment; if the problem persists, contact support at pexo.ai.
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
md - `400`: the file was rejected — possible reasons: file exceeds the size limit, file format is not supported, or the file content does not match its extension. Convert or compress the file and re-upload from scratch using `pexo-upload.sh`. - `401`: auth failure — see Auth and Proxy Errors above. - `404`: the file record was not found. The upload session may have been cleaned up. Re-upload from scratch using `pexo-upload.sh`. - `412`: the upload session has already expired or been completed. Re-upload from scratch using `pexo-upload.sh`. - `500`: an unexpected server error occurred. Retry in a moment; if the problem persists, contact support at pexo.ai.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly states that user-provided story, pitch, or pasted website content is sent to a hosted backend where scriptwriting, model selection, prompts, music, and subtitles happen server-side, yet it gives no clear privacy, retention, or transmission warning. Users may unknowingly transmit sensitive business, personal-brand, fundraising, or proprietary product information to a third-party service using an API key, creating a meaningful confidentiality and compliance risk.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Configure
Create
~/.pexo/config:text PEXO_BASE_URL="https://pexo.ai"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill explicitly requires shell-capable runtime components (
curl,jq,file) and instructs execution of multiple shell scripts, but it does not declare any tool scope restrictions such aspermissionsorallowed-tools. That creates an avoidable trust gap: a host may grant broader execution capability than users expect, increasing the blast radius if the scripts are modified, compromised, or behave unexpectedly.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The skill instructs persistent reuse of a
project_id, relays user requests verbatim to a hosted backend, and continues polling/reconnecting over time. That creates session-persistence and cross-turn data-retention risk: sensitive user content, revisions, and uploaded assets remain tied to a long-lived remote project, which can expose more history than necessary if projects are reused, mishandled, or later accessed by the wrong party.- Content
md story or pitch to the hosted Pexo agent and deliver the result; Pexo writes the script, generates the shots, and assembles a personal, polished video with music. ## Your role: relay, don't create Create a project, send the user's request **verbatim**, poll, deliver. Pexo's backend handles all creative work — scriptwriting, model choice, prompts, music. Adding your own direction
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Quick Start
1. Create config file
bash mkdir -p ~/.pexo
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - `403`: the download link has expired. Re-run `pexo-asset-get.sh` to get a fresh link. - `000`: network request failed before receiving a response. Check network connectivity and retry. - local filesystem write failure: the temp directory (`~/.pexo/tmp/`) is not writable or the disk is full. Free up space or set `PEXO_TMP_DIR` to a writable path. Notes:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code reads the sensitive PEXO_API_KEY and formats it into a Bearer Authorization header for outbound requests. While the behavior is core to the helper's purpose, this file itself provides no user-facing disclosure beyond internal comments, and the rule specifically calls for warning when sensitive credentials are accessed or transmitted unless documented elsewhere.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh err_file=$(mktemp) if [[ -n "$body" ]]; then http_code=$(curl -sS \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$_PEXO_REQUEST_TIMEOUT" \ -X "$method" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh err_file=$(mktemp) if [[ -n "$body" ]]; then http_code=$(curl -sS \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$_PEXO_REQUEST_TIMEOUT" \ -X "$method" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh set +o pipefail if [[ -n "$body" ]]; then curl -sS -N \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$timeout" \ -X POST \
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script executes
source "$config_path"on a path influenced byPEXO_CONFIGor defaulting to a user-writable file. That means any shell code placed in the config file will run with the privileges of whoever launches the diagnostic script, turning a configuration read into arbitrary code execution.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Beyond the code-execution issue itself, the script gives no explicit warning that opening the config file will execute shell code. Users are encouraged to create
~/.pexo/configas if it were inert data, which increases the chance they or another tool place unsafe content there and unknowingly trigger command execution.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh source "$config_path" else echo "$FAIL Config file not found: $config_path" echo " Create it with:" echo ' mkdir -p ~/.pexo && cat > ~/.pexo/config << EOF' echo ' PEXO_BASE_URL="https://pexo.ai"' echo ' PEXO_API_KEY="sk-<your-api-key>"'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh [[ -n "$storage_path" && "$storage_path" != "null" ]] || { echo "Error: upload credential missing storagePath" >&2; echo "$cred" >&2; exit 1; } # Phase 2: upload file http_code=$(curl -sS -X PUT -H "Content-Type: $mime_type" \ --data-binary "@$filepath" -o /dev/null -w '%{http_code}' "$upload_url" 2>/dev/null || echo "000") [[ "$http_code" =~ ^2 ]] || { echo "Error: upload failed with HTTP $http_code" >&2; exit 1; }
Static analysis
No suspicious patterns detected.