launch-video

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill requires the agent to relay users' exact words to the remote API and to deliver full asset URLs including all query parameters (which may contain signed tokens), forcing the LLM to handle and output secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The scripts use the PEXO_BASE_URL (https://pexo.ai) at runtime and rely on responses from that host (nextAction, recentMessages, preview/final asset info) to drive the agent’s orchestration and to relay server-generated prompts/instructions, so this remote endpoint directly controls the agent flow.