Terminal Session Replay

• Outcome: Pass
• Latest audit: May 28, 2026, 12:12 PM
• Version:
  1.0.0

Overview

This is a local terminal recording tool that behaves as described, but saved and exported sessions may contain sensitive terminal content.

Install only if you are comfortable recording terminal activity to disk. Avoid recording login flows, secrets, API keys, customer data, or private infrastructure output; review and redact transcripts before exporting or sharing; and delete or protect ~/.terminal-sessions/ when recordings are no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README encourages recording and exporting full terminal sessions but does not warn users that terminals commonly display secrets such as API keys, passwords, tokens, internal hostnames, and customer data. Because the stated use cases include debugging, documentation, and sharing, users may unintentionally persist and redistribute sensitive information from `~/.terminal-sessions/` or exported markdown files.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Recording full terminal sessions can capture sensitive material such as typed secrets, tokens, private command history, environment values, and confidential output. Because the skill encourages recording and sharing sessions without a prominent warning, users may unknowingly persist and redistribute credentials or other sensitive data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The record feature captures and persists a full terminal transcript, which can include passwords, tokens, API keys, private commands, and sensitive output, yet the tool provides only a generic recording notice and no explicit warning about secret exposure or retention. In the context of a terminal-session recording skill, this risk is especially relevant because users are likely to run administrative or debugging commands containing sensitive data.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The export function writes the full recorded terminal content to an arbitrary user-specified path, which can unintentionally spread sensitive transcripts into less protected locations or repositories. Because this skill is specifically designed for sharing/debugging terminal sessions, exporting increases the chance that captured secrets are redistributed or published without adequate warning.

VirusTotal

VirusTotal findings are pending for this skill version.