T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/_common.sh:7- Finding
Executable Configuration File Allows Arbitrary Shell Code Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
TikTok Video Ad
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Pexo video-ad wrapper, but it needs Review because its shell scripts handle credentials and local files in unsafe, under-scoped ways.
Review this before installing. Use it only for briefs and media you are comfortable sending to Pexo, protect the Pexo API key with restrictive file permissions or a secrets manager, do not set PEXO_BASE_URL to anything except a trusted HTTPS Pexo endpoint, and inspect ~/.pexo/config because these scripts execute it as shell code.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/_common.sh:228- Finding
Bearer Credential Can Be Sent to an Arbitrary or Plaintext API Endpoint
- Content
View full analysis
"$err_file") || curl_status=$? else http_code=$(curl -sS \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$_PEXO_REQUEST_TIMEOUT" \ -X "$method" \ -H "$(_pexo_auth_header)" \ -H "Content-Type: application/json" \ -D "$header_file" \ -o "$body_file" \ -w '%{http_code}' \ "$@" \ "${PEXO_BASE_URL}${path}" 2>"$err_file") || curl_status=$? fi ``` ### Technical Analysis Every API request attaches the bearer API key to `${PEXO_BASE_URL}${path}`. The base URL is accepted from the environment or executable configuration without validating its scheme or destination. Consequently, a value using plaintext HTTP exposes the key to network interception. A value naming an attacker-controlled host directly transmits the key to that host. The same unrestricted destination is used by the diagnostic script when validating credentials. A configurable endpoint can be useful for development, but unrestricted production use exceeds the minimum privileges required by a Skill declared to communicate with `https://pexo.ai`. ### Attack Path 1. An attacker modifies `PEXO_BASE_URL` through the environment or configuration file. 2. The value is changed to an attacker-controlled URL or a plaintext HTTP URL. 3. The user or agent runs a project, chat, ...[truncated 661 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pexo-upload.sh:74- Finding
Server-Supplied Upload and Download URLs Are Used Without Destination Validation
- Content
View full analysis
&2; echo "$cred" >&2; exit 1; } [[ -n "$asset_id" && "$asset_id" != "null" ]] || { echo "Error: upload credential missing assetId" >&2; echo "$cred" >&2; exit 1; } [[ -n "$storage_path" && "$storage_path" != "null" ]] || { echo "Error: upload credential missing storagePath" >&2; echo "$cred" >&2; exit 1; } # Phase 2: upload file http_code=$(curl -sS -X PUT -H "Content-Type: $mime_type" \ --data-binary "@$filepath" -o /dev/null -w '%{http_code}' "$upload_url" 2>/dev/null || echo "000") ``` ```bash download_url=$(echo "$asset" | jq -r '.downloadUrl // empty') # ... http_code=$(curl -sS -L \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$_PEXO_REQUEST_TIMEOUT" \ -o "$part_path" \ -w '%{http_code}' \ "$download_url" 2>"$err_file") || curl_status=$? ``` ### Technical Analysis The upload operation transmits the complete contents of a user-selected local media file to a URL supplied by the API response. No check requires HTTPS or restricts the host to an approved object-storage domain. Asset retrieval similarly requests a server-supplied URL and enables redirects with `-L`. There is no restriction against loopback, link-local, private-network, local-service, or plaintext destinations. Uploading user media to hosted storage is necessary for the declared service. Trusting an arbitrary URL and scheme without validation is broader than necessary and permits a compromised or spoofed backend to redirect local network activity or expo ...[truncated 1146 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pexo-asset-get.sh:55- Finding
Unsanitized Asset Identifier Can Escape the Asset Cache Directory
- Content
View full analysis
"$err_file") || curl_status=$? ``` ```bash mv -f "$part_path" "$local_path" ``` ### Technical Analysis The server-provided filename receives partial sanitization, but the caller-supplied asset identifier `aid` is embedded directly into the filesystem path. Slash characters, `..` path components, control characters, and absolute-path syntax are not rejected. The resulting path is neither canonicalized nor checked to ensure it remains beneath `tmp_dir`. `curl` writes to the constructed partial path and `mv -f` can overwrite an existing destination. Exploitation requires the metadata request for the crafted identifier to return a valid asset with a download URL. This can occur with a malicious or compromised configured backend. Even when exact targeting is constrained by the appended filename, the defect permits file creation outside the intended cache directory. ### Attack Path 1. An attacker influences the asset identifier passed to `pexo-asset-get.sh` and controls or compromises the API response. 2. The identifier contains traversal components such as `../`. 3. The backend returns asset metadata containing a valid `downloadUrl`. 4. The script concatenates the identifier into `local_path` without validation. 5. `curl` creates the part ...[truncated 660 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/pexo-upload.sh:70- Finding
Filename Is Interpolated Directly Into an API JSON Document
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
README.md:9- Finding
Installation Instructions Use Unpinned Remote Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding points to a real security-relevant issue: the skill uploads local files to remote storage/endpoints and accesses the local filesystem, yet those capabilities are not declared in permissions or clearly disclosed. In this context, the instruction to send the user's request verbatim and upload provided files to a third-party backend increases the risk of unintended data exfiltration or overbroad file access if the operator is not fully aware of the skill's transfer behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding points to a real security-relevant issue: the skill uploads local files to remote storage/endpoints and accesses the local filesystem, yet those capabilities are not declared in permissions or clearly disclosed. In this context, the instruction to send the user's request verbatim and upload provided files to a third-party backend increases the risk of unintended data exfiltration or overbroad file access if the operator is not fully aware of the skill's transfer behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding points to a real security-relevant issue: the skill uploads local files to remote storage/endpoints and accesses the local filesystem, yet those capabilities are not declared in permissions or clearly disclosed. In this context, the instruction to send the user's request verbatim and upload provided files to a third-party backend increases the risk of unintended data exfiltration or overbroad file access if the operator is not fully aware of the skill's transfer behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding points to a real security-relevant issue: the skill uploads local files to remote storage/endpoints and accesses the local filesystem, yet those capabilities are not declared in permissions or clearly disclosed. In this context, the instruction to send the user's request verbatim and upload provided files to a third-party backend increases the risk of unintended data exfiltration or overbroad file access if the operator is not fully aware of the skill's transfer behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding points to a real security-relevant issue: the skill uploads local files to remote storage/endpoints and accesses the local filesystem, yet those capabilities are not declared in permissions or clearly disclosed. In this context, the instruction to send the user's request verbatim and upload provided files to a third-party backend increases the risk of unintended data exfiltration or overbroad file access if the operator is not fully aware of the skill's transfer behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding points to a real security-relevant issue: the skill uploads local files to remote storage/endpoints and accesses the local filesystem, yet those capabilities are not declared in permissions or clearly disclosed. In this context, the instruction to send the user's request verbatim and upload provided files to a third-party backend increases the risk of unintended data exfiltration or overbroad file access if the operator is not fully aware of the skill's transfer behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding points to a real security-relevant issue: the skill uploads local files to remote storage/endpoints and accesses the local filesystem, yet those capabilities are not declared in permissions or clearly disclosed. In this context, the instruction to send the user's request verbatim and upload provided files to a third-party backend increases the risk of unintended data exfiltration or overbroad file access if the operator is not fully aware of the skill's transfer behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding points to a real security-relevant issue: the skill uploads local files to remote storage/endpoints and accesses the local filesystem, yet those capabilities are not declared in permissions or clearly disclosed. In this context, the instruction to send the user's request verbatim and upload provided files to a third-party backend increases the risk of unintended data exfiltration or overbroad file access if the operator is not fully aware of the skill's transfer behavior.
- Content
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
md - `400`: the file was rejected — possible reasons: file exceeds the size limit, file format is not supported, or the file content does not match its extension. Convert or compress the file and re-upload from scratch using `pexo-upload.sh`. - `401`: auth failure — see Auth and Proxy Errors above. - `404`: the file record was not found. The upload session may have been cleaned up. Re-upload from scratch using `pexo-upload.sh`. - `412`: the upload session has already expired or been completed. Re-upload from scratch using `pexo-upload.sh`. - `500`: an unexpected server error occurred. Retry in a moment; if the problem persists, contact support at pexo.ai.
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
md - `400`: the file was rejected — possible reasons: file exceeds the size limit, file format is not supported, or the file content does not match its extension. Convert or compress the file and re-upload from scratch using `pexo-upload.sh`. - `401`: auth failure — see Auth and Proxy Errors above. - `404`: the file record was not found. The upload session may have been cleaned up. Re-upload from scratch using `pexo-upload.sh`. - `412`: the upload session has already expired or been completed. Re-upload from scratch using `pexo-upload.sh`. - `500`: an unexpected server error occurred. Retry in a moment; if the problem persists, contact support at pexo.ai.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Configure
Create
~/.pexo/config:text PEXO_BASE_URL="https://pexo.ai"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states that all creative work happens server-side and that the skill delegates to a hosted backend, but it does not clearly warn users that their prompts, product data, and possibly sensitive marketing content will be transmitted off-box to a third-party service. This creates a real privacy and data-governance risk because users may unknowingly send confidential business information to an external processor.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill explicitly relies on shell execution (
curl,jq,file, and multiple.shscripts) but does not declare tool scope or permissions. That creates an authorization and review gap: users and hosting platforms cannot easily tell that the skill performs command execution, filesystem access, and network operations against a third-party API.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- name: tiktok-video-ad description: > Create native TikTok video ads with Pexo — vertical 9:16, sound-on, hook-first. Give it your product and Pexo writes the script in TikTok's voice, sequences fast-paced shots, picks the models, and delivers a ready-to-post ad with trending-style music. Use for TikTok ads: "tiktok ad", "tiktok video ad", "ad for tiktok", "vertical video ad". NOT for landscape or long-form ads
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
This documentation encourages persistent storage of an API credential on disk in a reusable config file, which increases the exposure window compared with ephemeral credential handling. Persistent secrets are more likely to be recovered from the filesystem, backups, shell-support archives, or other local compromise paths, and this file's setup context does not include compensating controls.
- Content
Quick Start
1. Create config file
bash mkdir -p ~/.pexo
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The setup instructions tell users to place a long-lived API key in a plaintext file under their home directory without any warning about credential sensitivity, file permissions, or safer storage options. If that file is readable by other local users, captured in backups, or exposed through logs/support bundles, the key could be reused to access the user's Pexo account and API resources.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - `403`: the download link has expired. Re-run `pexo-asset-get.sh` to get a fresh link. - `000`: network request failed before receiving a response. Check network connectivity and retry. - local filesystem write failure: the temp directory (`~/.pexo/tmp/`) is not writable or the disk is full. Free up space or set `PEXO_TMP_DIR` to a writable path. Notes:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This shell code automatically loads ~/.pexo/config and later requires PEXO_API_KEY, which means the skill accesses sensitive credentials implicitly. The only disclosure is in comments for developers, not a user-facing prompt, warning, or runtime message explaining that credentials will be read from local configuration.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh err_file=$(mktemp) if [[ -n "$body" ]]; then http_code=$(curl -sS \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$_PEXO_REQUEST_TIMEOUT" \ -X "$method" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh err_file=$(mktemp) if [[ -n "$body" ]]; then http_code=$(curl -sS \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$_PEXO_REQUEST_TIMEOUT" \ -X "$method" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh set +o pipefail if [[ -n "$body" ]]; then curl -sS -N \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$timeout" \ -X POST \
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script executes
source "$config_path"on a user-controlled file in the home directory, which runs arbitrary shell code rather than just reading configuration values. If that file is modified by malware, another local user, or a malicious setup step, running this diagnostic script will execute attacker commands with the user's privileges.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Sourcing a config file without warning or confirmation causes hidden code execution in a script that appears to be a harmless diagnostic utility. Users may reasonably expect checks and network tests, not execution of arbitrary shell statements embedded in
~/.pexo/config, which increases the chance of accidental compromise.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh source "$config_path" else echo "$FAIL Config file not found: $config_path" echo " Create it with:" echo ' mkdir -p ~/.pexo && cat > ~/.pexo/config << EOF' echo ' PEXO_BASE_URL="https://pexo.ai"' echo ' PEXO_API_KEY="sk-<your-api-key>"'
Static analysis
No suspicious patterns detected.