pexoai-agent
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a set of local bash scripts to perform API requests and file operations. These scripts are invoked with arguments derived from user input and rely on standard system utilities such as
curl,jq, andfileto process data and interact with the backend service.\n- [DATA_EXFILTRATION]: User-supplied media files and text instructions are transmitted to the vendor's backend API athttps://pexo.aifor video processing. This data transfer is the primary intended function of the skill and is documented as such in the setup and troubleshooting guides.\n- [EXTERNAL_DOWNLOADS]: Thepexo-asset-get.shscript retrieves produced video content from signed storage URLs generated by the vendor's API. Assets are downloaded into a local temporary cache directory (~/.pexo/tmp/) for delivery to the user.\n- [SAFE]: Heuristic detections regarding action concealment in the documentation were analyzed and found to be false positives. The text in question describes the asynchronous nature of the video production API, which is a standard technical detail provided for troubleshooting rather than a malicious attempt to hide execution. The skill demonstrates clear alignment between its stated purpose and its implementation.
Audit Metadata