Security audit
Security checks for vulnerabilities and agentic risk
This is mostly a vx troubleshooting guide, but it includes high-impact install and reset commands without enough safeguards for agent-run use.
Review this skill before installing. It is not evidence of theft or hidden malware, but do not let an agent run the remote install scripts, sudo commands, or the complete ~/.vx reset automatically. Require explicit approval, inspect downloaded scripts first, and back up ~/.vx before any deletion.
Although the static matcher also noted a broader rm -rf ~ pattern, the actual command shown deletes ~/.vx, which is still a high-risk destructive action. The skill context makes it more dangerous because it is presented as a standard recovery step in a troubleshooting guide that an agent may follow mechanically.
cp -r ~/.vx ~/.vx.backup
# Remove everything
rm -rf ~/.vx
# Reinstall
vx install node go uv
Although the static matcher also noted a broader rm -rf ~ pattern, the actual command shown deletes ~/.vx, which is still a high-risk destructive action. The skill context makes it more dangerous because it is presented as a standard recovery step in a troubleshooting guide that an agent may follow mechanically.
cp -r ~/.vx ~/.vx.backup
# Remove everything
rm -rf ~/.vx
# Reinstall
vx install node go uv
Piping curl output directly into bash removes the opportunity to inspect content and combines retrieval with execution in one step. This chaining pattern materially increases the risk of unnoticed arbitrary code execution from a compromised or changed remote script.
1. "command not found: vx"
→ vx is not installed. Run the install script.
→ Linux/macOS: curl -fsSL https://raw.githubusercontent.com/vx-org/vx/main/install.sh | bash
→ Windows: powershell -c "irm https://raw.githubusercontent.com/vx-org/vx/main/install.ps1 | iex"
2. "Failed to download" / "network error" (exit code 5)
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
# Check VX_HOME permissions
ls -la ~/.vx
# Fix permissions (Unix)
chmod -R u+rw ~/.vx
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
# Check VX_HOME permissions
ls -la ~/.vx
# Fix permissions (Unix)
chmod -R u+rw ~/.vx
The guide suggests running sudo vx install node as a fallback, even though it notes this is not recommended. Encouraging privileged execution of a package/tool installer increases the blast radius of mistakes or compromise, potentially modifying system-owned paths or installing attacker-controlled content as root.
chmod -R u+rw ~/.vx
sudo vx install node # Not recommended, use user installation
### Version Issues
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Install system dependencies
# Ubuntu/Debian
sudo apt-get install build-essential libssl-dev
# macOS (via Homebrew)
brew install openssl
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Install system dependencies
# Ubuntu/Debian
sudo apt-get install build-essential libssl-dev
# macOS (via Homebrew)
brew install openssl
The complete reset procedure includes destructive actions such as deleting ~/.vx and overwriting/restoring configuration, but it lacks an explicit warning about data loss, scope, and verification steps. In an agent-executed context, this can cause accidental loss of user state, cached artifacts, or custom local configuration without informed consent.
The guide recommends piping remote content directly into a shell/PowerShell interpreter without any integrity verification or warning. This is dangerous because compromise of the upstream source, transport, or repository content would immediately yield arbitrary code execution on the user's machine.
This section discusses delivery surfaces, PR comments, issue trackers, merged/released/deployed state, and public-safe communication practices. That capability is organizational workflow guidance rather than troubleshooting for vx installation, version conflicts, PATH issues, or other vx runtime/configuration problems.
The manifest describes a troubleshooting guide for vx installation, version, PATH, and related vx problems. The section on vx gh run view and GitHub Actions log triage adds a CI/GitHub operational capability that is not clearly justified by the stated local troubleshooting purpose, especially because it reaches into remote workflow-run inspection rather than vx-specific local diagnostics.
Fetching and executing an install script directly from a remote URL delegates full trust to external content at runtime. If the repository, CDN path, or network path is compromised, the user will execute arbitrary attacker-supplied code immediately.
1. "command not found: vx"
→ vx is not installed. Run the install script.
→ Linux/macOS: curl -fsSL https://raw.githubusercontent.com/vx-org/vx/main/install.sh | bash
→ Windows: powershell -c "irm https://raw.githubusercontent.com/vx-org/vx/main/install.ps1 | iex"
2. "Failed to download" / "network error" (exit code 5)