Video Ad

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:25 AM UTC
• Version: 0.1.1

Overview

The skill appears to be a real Pexo video-ad wrapper, but it needs review because its shell scripts handle credentials in ways that could expose the API key or run unexpected local code if config is tampered with.

Install only if you are comfortable sending ad briefs and selected media to Pexo. Keep ~/.pexo/config private with restrictive permissions, do not point PEXO_CONFIG or PEXO_BASE_URL at untrusted locations, and rotate the Pexo API key if you suspect the config or environment has been modified.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/_common.sh:212

Finding

Configurable API Origin Can Exfiltrate Bearer Credentials and User Content

Content

View full analysis

"$err_file") || curl_status=$? else http_code=$(curl -sS \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$_PEXO_REQUEST_TIMEOUT" \ -X "$method" \ -H "$(_pexo_auth_header)" \ -H "Content-Type: application/json" \ -D "$header_file" \ -o "$body_file" \ -w '%{http_code}' \ "$@" \ "${PEXO_BASE_URL}${path}" 2>"$err_file") || curl_status=$? fi ``` ```bash # scripts/pexo-doctor.sh:142-150 if [[ -n "${PEXO_BASE_URL:-}" && -n "${PEXO_API_KEY:-}" ]]; then tmp_body=$(mktemp) tmp_err=$(mktemp) http_code=$(curl -sS \ --connect-timeout 10 \ -H "Authorization: Bearer $PEXO_API_KEY" \ -H "Content-Type: application/json" \ -o "$tmp_body" \ -w '%{http_code}' \ "${PEXO_BASE_URL}/api/biz/projects?page_size=1" 2>"$tmp_err" || echo "000") ``` ### Technical Analysis `PEXO_BASE_URL` is ac ...[truncated 2406 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_common.sh:7

Finding

Configuration Files Are Executed as Arbitrary Shell Code

Content

View full analysis

~/.pexo/config << 'EOF' PEXO_BASE_URL="https://pexo.ai" PEXO_API_KEY="sk-" EOF ``` ### Technical Analysis The project presents `~/.pexo/config` as a simple key/value configuration file, but loads it with Bash `source`. Consequently, every shell construct in the file—including command substitutions, redirections, function definitions, and external command invocations—is executed with the privileges of the user running the Skill. The optional `PEXO_CONFIG` environment variable can point the scripts at another file. The implementation checks only that the path is a file; it does not validate ownership, reject symbolic links, inspect unsafe group or world write permissions, or parse only the expected variables. The setup instructions also create a file containing an API secret without explicitly setting directory mode `700` and file mode `600`. Actual exposure depends on the user's umask, but the instructions do not guarantee secure permissions. ### Attack Path 1. An attacker obtains write access to `~/.pexo/config`, replaces it through a symbolic-link or filesystem attack, or causes `PEXO_CONFIG` to reference an attacker-controlled file. 2. The attacker inserts a command such as a command substitution or an external program invocation. 3. The user or ...[truncated 899 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pexo-upload.sh:70

Finding

Unsafe Filename Interpolation Permits JSON Payload Injection

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill omits explicit disclosure of the effective permissions its scripts need, including network/API access and filesystem access to local media files. That matters because reviewers and users may underestimate the scope of data access and transmission performed by the shell scripts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill omits explicit disclosure of the effective permissions its scripts need, including network/API access and filesystem access to local media files. That matters because reviewers and users may underestimate the scope of data access and transmission performed by the shell scripts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill omits explicit disclosure of the effective permissions its scripts need, including network/API access and filesystem access to local media files. That matters because reviewers and users may underestimate the scope of data access and transmission performed by the shell scripts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill omits explicit disclosure of the effective permissions its scripts need, including network/API access and filesystem access to local media files. That matters because reviewers and users may underestimate the scope of data access and transmission performed by the shell scripts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill omits explicit disclosure of the effective permissions its scripts need, including network/API access and filesystem access to local media files. That matters because reviewers and users may underestimate the scope of data access and transmission performed by the shell scripts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill omits explicit disclosure of the effective permissions its scripts need, including network/API access and filesystem access to local media files. That matters because reviewers and users may underestimate the scope of data access and transmission performed by the shell scripts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill omits explicit disclosure of the effective permissions its scripts need, including network/API access and filesystem access to local media files. That matters because reviewers and users may underestimate the scope of data access and transmission performed by the shell scripts.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill omits explicit disclosure of the effective permissions its scripts need, including network/API access and filesystem access to local media files. That matters because reviewers and users may underestimate the scope of data access and transmission performed by the shell scripts.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 125)May include surrounding context.

md

- `400`: the file was rejected — possible reasons: file exceeds the size limit, file format is not supported, or the file content does not match its extension. Convert or compress the file and re-upload from scratch using `pexo-upload.sh`.
- `401`: auth failure — see Auth and Proxy Errors above.
- `404`: the file record was not found. The upload session may have been cleaned up. Re-upload from scratch using `pexo-upload.sh`.
- `412`: the upload session has already expired or been completed. Re-upload from scratch using `pexo-upload.sh`.
- `500`: an unexpected server error occurred. Retry in a moment; if the problem persists, contact support at pexo.ai.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 126)May include surrounding context.

md

- `400`: the file was rejected — possible reasons: file exceeds the size limit, file format is not supported, or the file content does not match its extension. Convert or compress the file and re-upload from scratch using `pexo-upload.sh`.
- `401`: auth failure — see Auth and Proxy Errors above.
- `404`: the file record was not found. The upload session may have been cleaned up. Re-upload from scratch using `pexo-upload.sh`.
- `412`: the upload session has already expired or been completed. Re-upload from scratch using `pexo-upload.sh`.
- `500`: an unexpected server error occurred. Retry in a moment; if the problem persists, contact support at pexo.ai.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

Configure

Create ~/.pexo/config:

text

PEXO_BASE_URL="https://pexo.ai"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill clearly relies on shell execution and networked helper scripts, but it does not declare an explicit tool scope such as allowed-tools or permissions. That weakens sandboxing and reviewability because an agent may invoke shell capabilities and related file/network operations without a narrowly declared boundary.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: video-ad
description: >
  Create scroll-stopping video ads with Pexo. Give it your product, brand, or a photo and Pexo
  writes the hook, sequences the shots, picks the best models, and delivers a finished ad with
  music — ready to run on Meta, TikTok, or YouTube. Use for advertising/promo video: "video ad",
  "make an ad", "product ad", "promo video", "commercial". NOT for explainer or tutorial content

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions explicitly tell the agent to send the user's request verbatim to a hosted backend, but provide no privacy warning, consent step, or guidance for sensitive data minimization. Users may unknowingly disclose confidential business plans, personal data, or proprietary media to a third-party service.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill encourages persistent storage of authentication material in a reusable local config file, which increases the lifetime and exposure surface of the credential. Persistent session material is more likely to be recovered from disk, backups, endpoint management tools, or unrelated local compromise than ephemeral credentials provided only at runtime.

Content

Scanner excerpt · references/SETUP-CHECKLIST.md (reported line 7)May include surrounding context.

Quick Start

1. Create config file

bash

mkdir -p ~/.pexo

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The setup instructions direct users to store a long-lived API key in a plaintext file under their home directory without any warning about credential sensitivity or file permission hardening. If the workstation is shared, backed up insecurely, or compromised by another local process, the key could be read and used to access the user's Pexo account and API resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file describes pexo-upload.sh transmitting user files to remote services and pexo-asset-get.sh downloading files into ~/.pexo/tmp/, but it presents these as troubleshooting details rather than explicit user-facing safety warnings. Under the markdown-file criteria, behaviors affecting privacy and local system state should be clearly warned about.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 181)May include surrounding context.

md

- `403`: the download link has expired. Re-run `pexo-asset-get.sh` to get a fresh link.
- `000`: network request failed before receiving a response. Check network connectivity and retry.
- local filesystem write failure: the temp directory (`~/.pexo/tmp/`) is not writable or the disk is full. Free up space or set `PEXO_TMP_DIR` to a writable path.

Notes:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This shell helper automatically sources a user config file containing credentials and constructs a Bearer authorization header for outbound requests. While the code has internal comments, it does not provide a user-facing warning, confirmation, or disclosure that credentials from local config will be used and transmitted to a remote service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_common.sh (reported line 228)May include surrounding context.

sh

err_file=$(mktemp)

  if [[ -n "$body" ]]; then
    http_code=$(curl -sS \
      --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \
      --max-time "$_PEXO_REQUEST_TIMEOUT" \
      -X "$method" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_common.sh (reported line 241)May include surrounding context.

sh

err_file=$(mktemp)

  if [[ -n "$body" ]]; then
    http_code=$(curl -sS \
      --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \
      --max-time "$_PEXO_REQUEST_TIMEOUT" \
      -X "$method" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_common.sh (reported line 335)May include surrounding context.

sh

set +o pipefail
  if [[ -n "$body" ]]; then
    curl -sS -N \
      --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \
      --max-time "$timeout" \
      -X POST \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/pexo-doctor.sh (reported line 79)May include surrounding context.

sh

source "$config_path"
else
  echo "$FAIL Config file not found: $config_path"
  echo "  Create it with:"
  echo '  mkdir -p ~/.pexo && cat > ~/.pexo/config << EOF'
  echo '  PEXO_BASE_URL="https://pexo.ai"'
  echo '  PEXO_API_KEY="sk-<your-api-key>"'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/pexo-upload.sh (reported line 83)May include surrounding context.

sh

[[ -n "$storage_path" && "$storage_path" != "null" ]] || { echo "Error: upload credential missing storagePath" >&2; echo "$cred" >&2; exit 1; }

# Phase 2: upload file
http_code=$(curl -sS -X PUT -H "Content-Type: $mime_type" \
  --data-binary "@$filepath" -o /dev/null -w '%{http_code}' "$upload_url" 2>/dev/null || echo "000")

[[ "$http_code" =~ ^2 ]] || { echo "Error: upload failed with HTTP $http_code" >&2; exit 1; }

Static analysis

No suspicious patterns detected.