Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for using VHS to create terminal screenshots and recordings, with disclosed install and demo commands but no hidden code or persistence.
Install only from package managers or container images you trust, approve sudo and Docker commands explicitly, and review any tape file before running it because VHS executes typed commands even when Hide prevents them from appearing in the recording.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
baseurl=https://repo.charm.sh/yum/
enabled=1
gpgcheck=1
gpgkey=https://repo.charm.sh/yum/gpg.key' | sudo tee /etc/yum.repos.d/charm.repo
sudo dnf install vhs ffmpeg
# Also install ttyd: https://github.com/tsl0922/ttyd/releases
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## What's This For?
When AI agents need to:
- Create terminal screenshots for documentation
- Record animated GIFs of CLI demos
- Generate video tutorials for command-line tools
- Produce consistent, reproducible terminal visuals
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
brew install vhs
# Fedora/RHEL
sudo dnf install vhs ffmpeg
# Or use Docker
docker run --rm -v $PWD:/vhs ghcr.io/charmbracelet/vhs demo.tape
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
brew install vhs
# Fedora/RHEL
sudo dnf install vhs ffmpeg
# Or use Docker
docker run --rm -v $PWD:/vhs ghcr.io/charmbracelet/vhs demo.tape
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
brew install vhs
# Fedora/RHEL
sudo dnf install vhs ffmpeg
# Or use Docker
docker run --rm -v $PWD:/vhs ghcr.io/charmbracelet/vhs demo.tape
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
The statement that the agent will 'automatically use this skill' when creating screenshots or recordings describes broad, implicit activation criteria. In an agent framework, overly broad auto-invocation can cause the skill to run in contexts the user did not intend, increasing the chance of unnecessary command execution or unsafe chaining with other tools.
The documentation frames hidden setup/cleanup as a way to produce 'clean output' while including a hidden cleanup command that runs rm temp-files. Hiding destructive actions from the recording can normalize unsafe patterns and cause accidental deletion if readers copy the example without understanding what is being removed.
The skill explicitly recommends hidden cleanup with cd - && rm temp-files and gives no warning about data loss, path safety, or ensuring the target is disposable. Because the command is both destructive and hidden from the rendered output, users may copy it into real workflows and delete files unintentionally.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
sudo dnf install vhs ffmpeg
docker run --rm -v $PWD:/vhs ghcr.io/charmbracelet/vhs demo.tape
## Documentation
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
sudo dnf install vhs ffmpeg
docker run --rm -v $PWD:/vhs ghcr.io/charmbracelet/vhs demo.tape
## Documentation
No suspicious patterns detected.