ClawHub
Back to skill

Security audit

vhs-recorder

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only skill is mostly coherent for making terminal recordings, but it includes hidden and overbroad destructive command examples that users or agents could run.

Review this skill before installing. It can be useful for VHS terminal demos, but do not copy its destructive cleanup examples as written. Run tape files only in disposable test directories or containers, pin third-party tools where possible, and replace global Docker or rm -rf cleanup commands with narrowly named demo resources.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned Third-Party Dependencies May Execute Unreviewed Code

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/examples.md:30
Finding

Docker Cleanup Command Stops All Running Containers

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)

Chaining Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

The chained cleanup command cd /tmp && rm -rf repo combines navigation with irreversible deletion, which obscures the destructive action and makes mistakes harder to notice. Chained destructive commands in examples are risky because users may tweak or reuse them with different paths, leading to accidental data loss.

Content

Scanner excerpt · references/examples.md (reported line 29)May include surrounding context.

Type "npm install" → Enter → Wait /added/ → Sleep 2s Type "npm run demo" → Enter → Wait /Complete/ → Sleep 3s Hide Type "cd /tmp && rm -rf repo" → Enter Show

text

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The Docker cleanup example uses docker stop $(docker ps -q), which stops all running containers on the host, not just the demo container. In a documentation context this is dangerous because users may paste it verbatim and disrupt unrelated services, development environments, or production-like workloads on their machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The 'Error Recovery' example displays rm -rf production-db/ as typed input before correction, normalizing an extremely destructive command without any warning. Even though it is framed as a near-miss, readers can still copy the snippet, and the dramatic presentation may encourage unsafe imitation rather than discourage it.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

rm -rf production-db/ is a destructive command targeting a path suggestive of important data, and the example presents it directly in a tape script. In the context of a terminal recording skill, including realistic destructive parameters materially increases the chance of harmful copy-paste or adaptation into real workflows.

Content

Scanner excerpt · references/examples.md (reported line 59)May include surrounding context.

Error Recovery (dramatic pause + backspace)

tape
Type "rm -rf production-db/"
Sleep 3s
Backspace 100
Type "rm -rf test-db/" → Enter → Sleep 2s

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

rm -rf test-db/ is still a destructive recursive deletion command, even if aimed at a less sensitive-looking directory. Although the impact may be lower than deleting a production path, presenting it as an example still teaches and normalizes unsafe command patterns in a context that does not require them.

Content

Scanner excerpt · references/examples.md (reported line 62)May include surrounding context.

Type "rm -rf production-db/" Sleep 3s Backspace 100 Type "rm -rf test-db/" → Enter → Sleep 2s Type "# Phew!" → Enter → Sleep 2s

text

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This example block contains hidden setup and cleanup commands, including cloning into /tmp and deleting a repo, without any warning that commands are executed in a shell and may alter the filesystem. Documentation for a recording tool is especially risky when commands are framed as copyable examples, because readers may assume they are harmless display-only actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The examples include destructive shell actions such as rm -rf repo and stopping containers, which are not essential to demonstrating terminal recording syntax and may be copied into real environments. Because these commands are presented as normal workflow steps with hidden execution, users may run them without appreciating the cleanup side effects.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly recommends using Hide/Show for installing dependencies, cloning repositories, building, creating test files, and clearing the terminal. Those actions can modify the local system or workspace while being intentionally concealed from the recording, which reduces transparency and can enable misleading or unsafe demonstrations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The hidden-sections guidance normalizes concealing system- and file-modifying actions without warning users that the recording may omit meaningful environmental changes. In a terminal-recording skill, this is especially risky because viewers may trust the visible transcript while missing hidden setup or cleanup that changes dependencies, repositories, or local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The multi-stage example performs git add . and git commit -m 'fix', which modify repository state and can capture broad file changes. The surrounding markdown does not warn that the example changes version control history or working tree contents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.