pexoai-agent

Pass

Audited by Gen Agent Trust Hub on Apr 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes a set of local bash scripts to perform API requests and file operations. These scripts are invoked with arguments derived from user input and rely on standard system utilities such as curl, jq, and file to process data and interact with the backend service.\n- [DATA_EXFILTRATION]: User-supplied media files and text instructions are transmitted to the vendor's backend API at https://pexo.ai for video processing. This data transfer is the primary intended function of the skill and is documented as such in the setup and troubleshooting guides.\n- [EXTERNAL_DOWNLOADS]: The pexo-asset-get.sh script retrieves produced video content from signed storage URLs generated by the vendor's API. Assets are downloaded into a local temporary cache directory (~/.pexo/tmp/) for delivery to the user.\n- [SAFE]: Heuristic detections regarding action concealment in the documentation were analyzed and found to be false positives. The text in question describes the asynchronous nature of the video production API, which is a standard technical detail provided for troubleshooting rather than a malicious attempt to hide execution. The skill demonstrates clear alignment between its stated purpose and its implementation.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 9, 2026, 01:47 PM