PixVerse AI Image and Video Generator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:40 AM UTC
• Version: 1.5.0

Overview

The skill is largely coherent as a PixVerse media-generation CLI guide, but it should be reviewed because it tells users to run an unpinned external npm CLI that handles account tokens, paid credits, cloud media uploads, and account assets.

Install only if you trust the PixVerse npm package and account integration. Prefer a pinned, verified CLI version over unversioned `npm install` or `npx`, avoid uploading sensitive local media, confirm asset IDs before deletion, and check the active workspace before running commands that consume credits or affect team assets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned External CLI Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:30-36
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

bash

npm install -g pixverse

Or run without installing:

bash

npx pixverse

The same unpinned global installation is repeated in SKILL.md:50-55 and capabilities/auth-and-account.md:363-370.

Technical Analysis

The Skill directs users and AI agents to download and execute the pixverse npm package without specifying an exact version or integrity value. In particular, npx pixverse may retrieve and immediately execute the version currently resolved by the npm registry.

The implementation of that package is not included in the audited project. Consequently, this project cannot independently establish the external executable's network destinations, installation scripts, credential-storage permissions, upload behavior, or handling of local files.

This dependency operates in a sensitive context: it receives OAuth authorization, accesses local media selected for upload, interacts with paid account or workspace credits, and stores credentials under ~/.pixverse/. A compromised, replaced, or unexpectedly changed npm release would execute with the invoking user's local privileges and authorized PixVerse account access.

Attack Path

1. An attacker compromises the npm package, its publisher account, or a newly published mutable release.
2. A user or agent follows the Skill and runs npm install -g pixverse or npx pixverse.
3. npm retrieves and executes the attacker-controlled package, including any applicable installation or runtime code.
4. The malicious package accesses resources available to the invoking process, potentially including the persisted PixVerse token and user-selected local media.
5. It may then transmit data, issue unauthorized account operations, consume credits, or execute additional commands under the user's operating-system identity.

Impact

...[truncated 607 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to an exact reviewed version in every installation and execution example, such as:

   bash

   npm install -g pixverse@1.5.0
   npx --yes pixverse@1.5.0
   

2. Publish and document the expected package integrity digest and provenance information.

3. Require verification of the npm publisher identity and package provenance before execution.

4. Avoid invoking an unversioned package through npx, which combines retrieval and immediate execution.

5. Provide a verifiable mapping between the npm artifact and the public source repository, ideally with reproducible builds and signed releases.

6. Review and pin transitive dependencies in the external CLI distribution.

7. Run the CLI with only the filesystem and account access needed for the requested media operation.

T08 · Insecure Dependencies

Note

• Location: scripts/update.sh:29

Finding

Mutable Git Update Without Remote or Revision Verification

Content

View full analysis

Vulnerability Details

File Location: scripts/update.sh:29-43
Vulnerability Type: Unverified update from a mutable Git branch
Risk Level: Low

Vulnerable Code

bash

echo "This will pull the latest skills from GitHub and may modify local files."
read -p "Continue? [y/N] " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
  echo "Aborted."
  exit 0
fi

git pull origin main --rebase

NEW_VERSION=$(tr -d '[:space:]' < VERSION 2>/dev/null || echo "unknown")

# Restore stashed changes if any
if [ "$STASHED" -eq 1 ]; then
  git stash pop || echo "Warning: stash pop had conflicts. Resolve manually."
fi

Technical Analysis

The updater pulls content from the repository's configured origin and mutable main branch without validating:

• That origin matches the documented PixVerse HTTPS repository.
• The expected commit identifier.
• A signed release tag.
• A cryptographic checksum or artifact signature.

The script does obtain interactive confirmation and does not directly execute newly downloaded content. These controls reduce immediacy and severity, but they do not establish the authenticity of the update source or revision.

Because the downloaded material consists of Skill instructions and executable scripts, a compromised upstream branch or locally redirected Git remote could alter future agent behavior or introduce malicious code for later invocation.

Attack Path

1. An attacker compromises the upstream main branch or changes the local repository's origin URL.
2. The user invokes scripts/update.sh.
3. The script warns that local files may change, and the user approves the operation.
4. git pull origin main --rebase retrieves and installs attacker-controlled Skill files.
5. On a subsequent Skill load or script invocation, the modified instructions influence the agent or the newly introduced code executes with the invoking user's privileges.

Impact Assessment

The immediate command modifies files inside the Git repos ...[truncated 574 chars]

Remediation

View remediation

Remediation Suggestions

1. Verify that the configured remote exactly matches the expected repository before pulling:

   bash

   EXPECTED_REMOTE="https://github.com/PixVerseAI/skills.git"
   ACTUAL_REMOTE="$(git remote get-url origin)"
   [ "$ACTUAL_REMOTE" = "$EXPECTED_REMOTE" ] || {
     echo "Unexpected origin: $ACTUAL_REMOTE" >&2
     exit 1
   }
   

2. Update from a pinned release tag or commit rather than mutable main.

3. Require signed commits or signed release tags and verify the signature before checkout.

4. Publish and validate a cryptographic checksum for each release.

5. Display the remote URL, current revision, target revision, and signature status before requesting confirmation.

6. Fetch and inspect the target revision before changing the working tree.

7. Do not automatically execute any newly retrieved script as part of the update process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says the skill is a CLI for generating AI videos and images. The supplied code chunk does not generate media or invoke any model APIs; instead, its sole purpose is to compare a local version file against a remote GitHub version file and notify the user about available updates. This is a materially different primary purpose. While version checking can be a supporting utility for a larger tool, this specific code chunk's behavior is not represented by the declared description and includes undeclared network access to GitHub for update checking.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents the skill as a command-line tool for AI image/video generation. However, the supplied code chunk does not generate media or invoke any AI models. Its primary purpose is repository maintenance: updating the local skills checkout from GitHub, handling local changes with git stash, and reporting version changes. This is a materially different function from the declared purpose, so it is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · capabilities/create-and-edit-image.md (reported line 143)May include surrounding context.

T2I basic (recommended: high-quality model)

bash

pixverse create image --prompt "A serene lake at dawn with mist rising" --model gemini-3.1-flash --quality 2160p --json

T2I with full options

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · workflows/text-to-image-to-video.md (reported line 18)May include surrounding context.

Full Example

bash

# Step 1: Generate image
IMG_RESULT=$(pixverse create image --prompt "A cyberpunk cityscape at night with neon lights" --model gemini-3.1-flash --quality 2160p --json)
IMAGE_ID=$(echo "$IMG_RESULT" | jq -r '.image_id')

# Step 2: Get image URL

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill explicitly instructs use of shell commands (npm install -g pixverse, npx pixverse, authentication, downloads) but does not declare any tool scope or allowed-tools boundary. In an agent setting, that omission can lead to over-broad shell execution and network access beyond what a user or orchestrator may expect, increasing the chance of unintended command execution and credential or filesystem exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The markdown explicitly states 'English only', which is a natural-language locale restriction. Under the policy, forcing a specific language is a violation unless the skill offers user choice or clearly documents a justified region- or compliance-specific constraint.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using npx pixverse without a pinned version causes on-demand retrieval of whatever package version is currently published, which creates a supply-chain risk and makes executions non-reproducible. In an autonomous agent context, this can result in silently running malicious or unexpected code from a compromised or newly changed package release.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents a destructive pixverse asset delete <id> command and even provides a direct example, but it gives no warning about permanence, no recommendation to verify the asset ID first, and no confirmation or dry-run guidance. In an agent or automation context, this increases the chance of accidental deletion of user assets through mis-selection, scripting mistakes, or unsafe autonomous execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs users that an authentication token will be stored in ~/.pixverse/, but it provides no warning about protecting that directory, avoiding token disclosure, or using a safer override mechanism. If the host is shared, backed up insecurely, or the directory has weak permissions, the token could be copied and reused to access the account and consume credits or access account/workspace data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · capabilities/auth-and-account.md (reported line 350)May include surrounding context.

pixverse config defaults set --mode video --model v6 --quality 1080p --json

text

This sets default values that apply when you run `pixverse create video` without specifying those flags explicitly. Command-line flags always override defaults.

### Reset per-mode creation defaults

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The single-image workflow explicitly warns that local files are auto-uploaded to PixVerse cloud storage and should not contain sensitive content, but the multiple-image workflow omits the same warning despite using the same upload behavior for local files. This can mislead users into uploading multiple private or confidential images without realizing they are being transferred off-host to third-party storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This is a true security/privacy issue because the skill accepts a local video path and later states that local files are uploaded to PixVerse cloud storage, but the user-facing command guidance does not clearly warn about that data transfer at the point of use. A user may unknowingly upload sensitive or proprietary video content, creating confidentiality and compliance risk, especially in enterprise or regulated environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs users to provide local video and audio file paths and to download generated assets, but it does not warn that these actions may upload local files to a third-party service or write files back to the local system. In an agent setting, this can cause unintended disclosure of sensitive media or unexpected filesystem side effects if the agent follows the instructions automatically.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guidance says the skill must preserve original intent and not invent missing elements, but the examples and multi-shot transformations add details such as ages, environment specifics, physical actions, and dramatic beats not supplied by the user. In an agent setting, this undermines trust in the skill's contract and can lead to fabricated or unsafe prompt content being attributed to the user.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly claims it only optimizes prompt text and does not select parameters, but later instructs the agent to always include generation flags. This creates hidden behavior outside the declared scope, which can cause unauthorized parameter changes, unexpected tool invocation behavior, or policy bypass in systems that rely on skill boundaries for safe orchestration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill repeatedly instructs users to provide local image and video paths to a third-party service, but it does not warn that those files will be uploaded off-device and may contain sensitive personal data. In this context, the omission is meaningful because the templates explicitly encourage use of personal photos for effects like portraits and viral transformations, increasing the chance that users unknowingly transmit private biometric or personal content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly allows local file paths and remote image URLs as transition inputs but does not disclose that these assets will be uploaded to or fetched by the external PixVerse service. This can cause users to unknowingly transmit sensitive local images or provide internal/private URLs to a third party, creating privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Persisting active workspace state across CLI sessions can cause subsequent commands to operate in an unintended tenant context, consuming the wrong credits or exposing/modifying the wrong assets. In an agent or automation setting, this increases the risk of cross-workspace mistakes because state survives beyond the immediate command and is synced from both local storage and server state.

Content

Scanner excerpt · capabilities/workspace.md (reported line 23)May include surrounding context.

md

Key facts:
- The **server** is the source of truth for the active workspace — the CLI syncs with it
- All creation commands (`create video`, `create image`, etc.) automatically operate in the active workspace via the `Workspace-Id` HTTP header
- Switching workspace changes which credits are consumed and which assets are visible
- Workspace state persists across CLI sessions in `~/.pixverse/`

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · capabilities/workspace.md (reported line 193)May include surrounding context.

Global Override: --workspace-id

Run any command in a specific workspace without switching the persistent active workspace.

bash

pixverse --workspace-id 42 create video --prompt "A sunset" --json

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · references/mondo-poster/genre-templates.md (reported line 5)May include surrounding context.

md

> Based on [qiaomu-mondo-poster-design](https://github.com/joeseesun/qiaomu-mondo-poster-design) by [@vista8](https://x.com/vista8).

Genre-specific prompt templates for creating Mondo-style posters, book covers, and album covers. Each template includes visual approach, color guidance, and a ready-to-fill prompt template.

**Placeholders:** Replace `[BRACKETED TEXT]` with your specific content.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents pixverse config reset --json but does not warn that resetting configuration is a write operation that can discard the user's customized CLI settings. For markdown skills, destructive or state-changing behavior that affects user data or environment should be disclosed clearly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The rules say not to fabricate missing elements such as scene or environment details, but the example changes 'a cat sitting on a window' to 'on a windowsill' and justifies it as added spatial precision. That is presented behavior inconsistent with the documented non-invention constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The I2V example adds 'across the frame' and 'with a soft breeze' even though the user only asked for 'gentle movement.' This contradicts the earlier instruction not to invent missing elements and to include only information the user actually supplied.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file documents that workspace switch persists across CLI sessions, which can affect which credits are consumed and which assets are visible in later commands. Although the behavior is described, there is no explicit warning or caution callout highlighting the risk of unintentionally operating in the wrong workspace after switching.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comment says the updater is 'Safe' because it checks for local changes before pulling, but the script does more than a benign check: it stashes local changes, rebases from origin, and then reapplies the stash, which can modify the working tree and introduce conflicts. This is an intent-level mismatch between the reassuring documentation and the actual side-effectful update behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.