ClawHub
Back to skill

Security audit

vhs-recorder

Security checks across malware telemetry and agentic risk

Overview

This is a coherent terminal-recording guide, but its runnable examples include destructive and overly broad shell commands without enough safety framing.

Install only if you will review generated .tape files before running them. Treat VHS tapes like scripts: use a disposable workspace, replace rm -rf and Docker stop-all examples with narrowly scoped demo resources, and do not copy production-like deletion examples into real environments.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This markdown file includes a hidden cleanup command using `rm -rf repo`, which deletes files, but the surrounding documentation provides no warning that the example performs deletion. Because markdown files should warn about behaviors affecting user data or system integrity, this omission is a quality and safety issue.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The example uses `docker stop $(docker ps -q)`, which stops all running containers, but the markdown does not warn users about its broad and disruptive effect. This can affect system integrity or interrupt active services if copied into a real environment.

Missing User Warnings

High
Confidence
97% confidence
Finding
The 'Error Recovery' example prominently shows `rm -rf production-db/` followed by `rm -rf test-db/`, both of which are destructive deletion commands, yet no warning indicates that these are hazardous examples. Even though the first command is not executed, the markdown presents dangerous shell patterns without caution, which could affect user data if reused.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.