Pexo Video Agent

• Outcome: Review
• Latest audit: Jul 21, 2026 · 2:35 AM UTC
• Version: 0.3.12

Overview

This is a coherent Pexo video-generation skill, but it sends prompts and media to Pexo and can approve credit-gated work after user approval.

Install only if you are comfortable sending your video brief, uploaded media, and generated outputs to Pexo. Do not include secrets, confidential business data, regulated personal data, or untrusted remote files unless you have approval. Review credit estimates carefully and only approve billing confirmations you intend to pay for; treat full download URLs as private until they expire.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to execute multiple shell scripts, but the metadata does not declare shell permissions. This creates a transparency and control gap: a host may allow the skill to run with capabilities users or policy systems did not expect, reducing the chance of proper sandboxing and review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The public description frames the skill as simple video generation, but the body includes broader operational behavior: project lifecycle management, polling/orchestration, billing confirmation handling, diagnostics, uploads/downloads, and external data transfer. That mismatch can cause users or reviewers to underestimate the scope of actions taken and the data exposed to the third-party service.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The skill advertises URL-to-video via page scraping, but later states that Pexo cannot crawl URLs and requires files to be downloaded first. This inconsistency is security-relevant because it obscures where URL content is fetched and processed, increasing the risk of unsafe retrieval of third-party content or unexpected data transfer workflows.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill encourages sending user prompts, uploaded media, scripts, audio, and possibly URL-derived content to an external service without a prominent privacy warning. Users may unknowingly transmit sensitive personal, corporate, or copyrighted material to a third party, creating confidentiality and compliance risk.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The skill instructs the agent to download third-party file URLs before upload, but does not clearly warn about handling untrusted external content. That can expose the environment to risky files, unexpected large downloads, copyrighted material, or sensitive content from remote sources without informed user consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script programmatically submits a billing approval with `decision: "approve"` while explicitly marking the event as `user_visible: false`, creating a non-transparent approval path for a credit-gated action. Although it checks that a pending confirmation exists and that the supplied confirmation ID matches, the script itself does not enforce any direct user interaction or display of the billing details at the moment of approval, so a caller can finalize spend in a way that is hard to audit from the user side.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instructions require relaying the user's message verbatim to a backend service, which can forward any secrets, personal data, internal URLs, or confidential business information the user includes. Because the policy explicitly discourages filtering or summarizing, the skill increases the chance of oversharing sensitive data to a third party.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The delivery workflow tells the agent to expose full presigned asset URLs including all query parameters. Those query parameters are bearer-style access tokens; if logged, forwarded, or exposed in chat history, anyone with the URL may access the asset until expiry.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/SETUP-CHECKLIST.md:17

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/pexo-doctor.sh:93

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:58