YouTube Short Maker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:30 AM UTC
• Version: 0.1.1

Overview

This is a coherent Pexo video wrapper, but it needs review because its credential handling and install path create avoidable account-security risk.

Install only if you trust Pexo and are comfortable sending prompts, uploaded media, project metadata, and generated assets to its hosted service. Protect ~/.pexo/config as a secret, avoid using untrusted PEXO_CONFIG or PEXO_BASE_URL values, prefer restrictive file permissions, and pin the installer/source before use where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Unpinned Remote Installer and Skill Source

Content

View full analysis

Remediation

View remediation

add ... ``` 2. Pin the GitHub source to an immutable commit SHA or signed release tag rather than the default branch. 3. Publish checksums or signed provenance for release artifacts. 4. Use a lockfile where the installation mechanism supports one. 5. Document the expected installer version and source commit so users can verify them before execution. 6. Avoid recommending elevated execution such as `sudo`; explicitly state that installation should run with ordinary user privileges. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_common.sh:7

Finding

Shell Execution of the User-Selected Configuration File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_common.sh:228

Finding

Bearer API Key Can Be Sent to an Unvalidated Configured Endpoint

Content

View full analysis

"$err_file") || curl_status=$? else http_code=$(curl -sS \ --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \ --max-time "$_PEXO_REQUEST_TIMEOUT" \ -X "$method" \ -H "$(_pexo_auth_header)" \ -H "Content-Type: application/json" \ -D "$header_file" \ -o "$body_file" \ -w '%{http_code}' \ "$@" \ "${PEXO_BASE_URL}${path}" 2>"$err_file") || curl_status=$? fi ``` The authorization header is constructed at `scripts/_common.sh:32-34`: ```bash _pexo_auth_header() { printf 'Authorization: Bearer %s' "$PEXO_API_KEY" } ``` Configuration validation at `scripts/_common.sh:15-24` only verifies that the values are nonempty: ```bash if [[ -z "${PEXO_BASE_URL:-}" ]]; then missing+=("PEXO_BASE_URL") fi if [[ -z "${PEXO_API_KEY:-}" ]]; then missing+=("PEXO_API_KEY") fi ``` ### Technical Analysis Every API request sends `PEXO_API_KEY` as a bearer token to the host selected by `PEXO_BASE_URL`. The code does not verify that the base URL: - Uses HTTPS. - Resolves to the declared `pexo.ai` service. - Belongs to an explicitly trusted host allowlist. - Excludes embedded user information, unusual ports, or local-network destinations. The configurable endpoint may be useful for development or self-hosted environments, but transmitting a production credential to any configured URL is unsafe without a clear trust policy. A configuration mistake, malicious environ ...[truncated 1379 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: references/SETUP-CHECKLIST.md:7

Finding

API Key Configuration Is Created Without Restrictive File Permissions

Content

View full analysis

~/.pexo/config << 'EOF' PEXO_BASE_URL="https://pexo.ai" PEXO_API_KEY="sk-" EOF ``` ``` ### Technical Analysis The setup instructions store the Pexo API key in a plaintext file but do not set restrictive permissions on either `~/.pexo` or `~/.pexo/config`. The resulting mode depends on the user's current `umask`. With a common `022` umask, the directory can be created as `0755` and the file as `0644`, making the API key readable by other local users. The scripts also do not reject configuration files that are group-readable, world-readable, or owned by another user. Storing an API key locally is expected for this workflow, but making it potentially readable outside the account violates least-exposure principles. ### Attack Path 1. A user follows the documented setup instructions under a permissive or typical `umask`. 2. `~/.pexo/config` is created with group-readable or world-readable permissions. 3. Another local user or process operating under a different account reads the file. 4. The attacker extracts `PEXO_API_KEY`. 5. The attacker uses the key against Pexo within the permissions and credit limits attached to the victim's account. This path requires local read access under the resulting filesystem permissions; it is not a remote vulnerability on its own. ### Impact Assessment The primary impact is disclosure of the Pexo API key and unauthorized use of the associated account. This may expose project information and generated assets or permit consumption of account credits, depending on server-side API authorization. The issue does not directly grant operating-system privileges beyond the attacker's existing local access. ]]>

Remediation

View remediation

~/.pexo/config <<'EOF' PEXO_BASE_URL="https://pexo.ai" PEXO_API_KEY="sk-" EOF ``` 2. Explicitly enforce permissions: ```bash chmod 700 ~/.pexo chmod 600 ~/.pexo/config ``` 3. Have all scripts verify that the configuration is owned by the current user and is not accessible by group or other users. 4. Refuse to load unsafe files, or emit a clear blocking error with exact corrective commands. 5. Recommend a platform credential store or secret manager where available instead of long-lived plaintext credentials. 6. Avoid printing the complete key in diagnostics or errors; the existing masking behavior should be retained and strengthened for short keys. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill creates YouTube Shorts end-to-end, including script writing, shot generation, model selection, and final assembly with music and captions. The actual code does none of that. It performs a narrow asset-management function: querying a project asset endpoint, reading a download URL, downloading the file locally, and returning metadata. This is a materially different primary purpose and introduces undeclared capabilities around asset retrieval and local file download/storage. Therefore the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a high-level content generation skill that turns a topic into a finished YouTube Short. The supplied code instead implements a narrow infrastructure function: sending a message to an existing Pexo project and returning an async acknowledgement. While this could be a supporting component inside a larger Shorts-generation system, the code chunk itself does not perform the advertised creation tasks or enforce YouTube Shorts-specific behavior such as 9:16 formatting, hooks, pacing, script generation, shot generation, model selection, music, or captions. Its actual purpose is materially different and more generic than the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a user-facing content creation capability: generating YouTube Shorts with scripts, visuals, models, music, and captions. The actual code does none of that. It is purely an environment diagnostic and setup-validation script for Pexo shell tooling. It reads a local config file, inspects environment variables, checks installed command-line tools, probes network access, and validates an API key against a backend endpoint. These are materially different capabilities and a different primary purpose from creating short-form videos. Therefore, the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a creative video-generation workflow for YouTube Shorts. However, the code does not generate scripts, shots, models, music, captions, or videos, nor does it operate on user topics or short-form media settings. Its sole purpose is to call an entitlements endpoint (/api/biz/auth/entitlements), output credit/plan information, and advise the user to buy credits if depleted. This is a materially different primary purpose and an undeclared capability related to account/billing status, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents an end-to-end YouTube Shorts generation capability, but the supplied script only initializes a blank Pexo project and outputs its project ID. This is a materially narrower and different function than described. While project creation could be a supporting step in a larger workflow, the provided code chunk by itself does not implement the advertised core behaviors for generating and assembling a finished short video.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a creative generation capability: taking a topic and producing a YouTube Short with script, shots, models, music, captions, and final assembly. The actual code chunk does none of that. It only queries Pexo project and history endpoints, processes status fields, and emits a control-plane view for orchestration about what the caller should do next. While this may support a larger video-production system, this specific code's primary purpose is project-state retrieval and workflow coordination, which is materially different from the declared end-user functionality. Therefore this is a clear description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch between the declared description and the actual code behavior. The description claims a creative video-generation capability specifically for producing YouTube Shorts. The code shown only implements project listing functionality for an authenticated user, including argument parsing and validation for page and page size, then issuing a GET request to a projects endpoint. This is a materially different primary purpose and indicates undeclared data-access behavior unrelated to the stated Shorts-generation functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an end-to-end AI video creation capability for YouTube Shorts. In contrast, the actual code only implements a three-step media asset upload flow to a project backend. It does not generate scripts, create shots, select models, assemble videos, or enforce/create vertical 9:16 Shorts. Its primary purpose is materially different: asset ingestion rather than short-form video production. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 125)May include surrounding context.

md

- `400`: the file was rejected — possible reasons: file exceeds the size limit, file format is not supported, or the file content does not match its extension. Convert or compress the file and re-upload from scratch using `pexo-upload.sh`.
- `401`: auth failure — see Auth and Proxy Errors above.
- `404`: the file record was not found. The upload session may have been cleaned up. Re-upload from scratch using `pexo-upload.sh`.
- `412`: the upload session has already expired or been completed. Re-upload from scratch using `pexo-upload.sh`.
- `500`: an unexpected server error occurred. Retry in a moment; if the problem persists, contact support at pexo.ai.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 126)May include surrounding context.

md

- `400`: the file was rejected — possible reasons: file exceeds the size limit, file format is not supported, or the file content does not match its extension. Convert or compress the file and re-upload from scratch using `pexo-upload.sh`.
- `401`: auth failure — see Auth and Proxy Errors above.
- `404`: the file record was not found. The upload session may have been cleaned up. Re-upload from scratch using `pexo-upload.sh`.
- `412`: the upload session has already expired or been completed. Re-upload from scratch using `pexo-upload.sh`.
- `500`: an unexpected server error occurred. Retry in a moment; if the problem persists, contact support at pexo.ai.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

Configure

Create ~/.pexo/config:

text

PEXO_BASE_URL="https://pexo.ai"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README says creative work happens server-side but does not clearly warn users that their prompts, topics, and potentially sensitive content are transmitted to a hosted backend for processing. This creates a real privacy and data-handling risk because users may unknowingly submit confidential material to a third-party service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill explicitly requires shell runtime tools and instructs use of multiple shell scripts, but it does not declare a restrictive tool scope such as allowed tools or permissions. That creates an unnecessary expansion of execution capability and weakens enforcement boundaries, increasing the risk of unintended or abusive shell use if the skill is invoked in a broader agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill sends the user's prompt verbatim to a hosted third-party service and may also upload user files, but the user-facing description does not prominently warn about that data transfer. This can cause inadvertent disclosure of sensitive text, media, or embedded metadata to an external service, especially because the workflow encourages exact relay and file upload.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill creates and reuses persistent server-side projects, polls them over time, and instructs that revisions must continue within the same project. That persistence can retain user content, uploaded assets, conversation history, and derivative outputs longer than a user may expect, creating privacy and cross-session data exposure risk if retention, visibility, or consent are not made explicit.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

topic to the hosted Pexo agent and deliver the result; Pexo scripts it, generates the shots, and
assembles the Short with music and captions.

## Your role: relay, don't create

Create a project, send the user's request **verbatim**, poll, deliver. Pexo's backend handles
all creative work — scriptwriting, model choice, prompts, music. Adding your own direction

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The instructions encourage persistent local storage of an authentication token in a reusable config file, which increases the window of exposure compared with ephemeral credentials. In the context of an automation skill that interacts with a paid external API, a stolen persisted key could be reused to impersonate the user, generate content, spend credits, or query account resources until revoked.

Content

Scanner excerpt · references/SETUP-CHECKLIST.md (reported line 7)May include surrounding context.

Quick Start

1. Create config file

bash

mkdir -p ~/.pexo

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup guide instructs users to place a live API key in a plaintext file under their home directory without any warning about credential sensitivity, file permissions, or safer alternatives. If the file is left with permissive defaults, included in backups, exposed through multi-user access, or accidentally copied/shared, the key could be stolen and used to access the Pexo account and consume credits or access associated data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 181)May include surrounding context.

md

- `403`: the download link has expired. Re-run `pexo-asset-get.sh` to get a fresh link.
- `000`: network request failed before receiving a response. Check network connectivity and retry.
- local filesystem write failure: the temp directory (`~/.pexo/tmp/`) is not writable or the disk is full. Free up space or set `PEXO_TMP_DIR` to a writable path.

Notes:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a skill for creating YouTube Shorts, but this helper automatically loads credentials and configuration from a user-local file in the home directory. Accessing local auth material is an implementation capability that is not justified by the user-facing purpose as described here, especially since the manifest does not mention local config or credential handling.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_common.sh (reported line 228)May include surrounding context.

sh

err_file=$(mktemp)

  if [[ -n "$body" ]]; then
    http_code=$(curl -sS \
      --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \
      --max-time "$_PEXO_REQUEST_TIMEOUT" \
      -X "$method" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_common.sh (reported line 241)May include surrounding context.

sh

err_file=$(mktemp)

  if [[ -n "$body" ]]; then
    http_code=$(curl -sS \
      --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \
      --max-time "$_PEXO_REQUEST_TIMEOUT" \
      -X "$method" \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This function calls an entitlements endpoint and emits a top-up URL and credit-purchase guidance, which is an account/billing capability rather than direct Short creation. The manifest only describes script/shots/models/music/captions assembly for Shorts, so account credit inspection and purchase prompting are not clearly justified by the stated purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/_common.sh (reported line 335)May include surrounding context.

sh

set +o pipefail
  if [[ -n "$body" ]]; then
    curl -sS -N \
      --connect-timeout "$_PEXO_CONNECT_TIMEOUT" \
      --max-time "$timeout" \
      -X POST \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script unconditionally sources a config file from a user-controlled path (PEXO_CONFIG or ~/.pexo/config), which executes arbitrary shell code in the current process rather than merely parsing key/value settings. If an attacker can modify that file or influence PEXO_CONFIG, running this diagnostic script becomes a code-execution vector, which is more serious than a normal configuration read.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.