Security audit
Security checks for vulnerabilities and agentic risk
This skill is a plausible proof-recording tool, but it needs Review because its setup and proof scripts can run broad local commands, install system packages, and save sensitive proof data without enough guardrails.
Install only after reviewing the scripts. Run it in a development or disposable environment, use trusted proof specs only, avoid production or sensitive authenticated pages, and manually inspect or redact videos, screenshots, logs, and API results before committing. Prefer pinning dependencies and handling sudo/system package installation manually.
scripts/record-proof.js:42Shell Command Injection Through Unvalidated Port Values
scripts/record-proof.js:211Shell Command Injection Through the Output Directory During FFmpeg Conversion
scripts/record-proof.js:163Arbitrary File Write Through Screenshot Name Path Traversal
scripts/setup.sh:7Mutable and Unlocked Dependency Installation Creates Supply-Chain Exposure
scripts/api-proof.js:120Sensitive API and Browser Data Can Be Persisted and Committed Without Redaction
The declared description emphasizes visual proof artifacts: screen recordings, screenshots, and demonstrating software working after coding tasks. The supplied code instead implements an API/backend testing/proof script. It optionally launches a server via a shell command, waits for localhost readiness, performs HTTP requests, checks status/body assertions, and saves markdown and JSON summaries. While generating test logs/artifacts loosely aligns with 'proof,' the core purpose is materially different from video demo capture, and key declared capabilities (video recording and screenshots) are absent. The ability to spawn and terminate a server process is also an undeclared capability, though secondary to the main mismatch.
Referenced artifact was not completely inspected
node scripts/record-proof.js --spec proof-spec.yaml --output ./proof-artifacts
Referenced artifact was not completely inspected
node scripts/record-proof.js --spec proof-spec.yaml --output ./proof-artifacts
Referenced artifact was not completely inspected
For backend/API changes with no UI, use `api-proof.js`:
Referenced artifact was not completely inspected
For backend/API changes with no UI, use `api-proof.js`:
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
else
echo " ffmpeg not found — attempting install..."
if command -v apt-get &> /dev/null; then
sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg
elif command -v brew &> /dev/null; then
brew install ffmpeg
elif command -v dnf &> /dev/null; then
The --noconfirm parameter is a tool-abuse pattern because it suppresses safeguards in a system package manager and can force changes to the host without validation. In this script it is paired with sudo, making accidental or malicious misuse materially more dangerous due to privileged unattended execution.
elif command -v dnf &> /dev/null; then
sudo dnf install -y ffmpeg
elif command -v pacman &> /dev/null; then
sudo pacman -S --noconfirm ffmpeg
else
echo " ⚠ Could not install ffmpeg automatically. Install manually for mp4 conversion."
echo " Video recording still works (produces .webm without ffmpeg)."
The skill clearly instructs the agent to execute shell commands, start local servers, install dependencies, access the network, and produce artifacts, yet it declares no tool scope or allowed-tools restrictions. In an agent environment, this omission weakens policy enforcement and can lead to overbroad execution authority, especially because user-provided start commands are explicitly supported.
The trigger phrases include broad natural-language prompts like 'show me it working' and 'prove it works,' which can cause unintended invocation in unrelated contexts. Because this skill can install software, start services, visit URLs, and capture artifacts, accidental activation materially increases the chance of unnecessary command execution and data exposure.
This skill records screens, screenshots, and console logs, which can easily capture secrets, tokens, personal data, internal URLs, or other sensitive information visible in the browser or emitted to logs. The absence of a prominent warning or redaction guidance is dangerous because the artifacts are explicitly intended to be committed and shared as PR evidence.
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
steps:
- goto: "/path" # Navigate (relative or absolute URL)
- click: "text=Button" # Playwright selector
- fill: # Clear + fill input
selector: "#email"
value: "user@example.com"
- type: # Keystroke-by-keystroke input
The script executes a user-controlled start_command via spawn('sh', ['-c', spec.start_command]), which gives the skill arbitrary shell execution capability. In the context of an agent skill, this is more dangerous than ordinary local tooling because the command can come from spec/CLI input and the capability exceeds narrowly scoped API proof generation, enabling execution of unintended commands on the host.
The script invokes npx playwright without pinning an exact package version for the executed CLI path, which allows the resolved package/code to change over time and creates supply-chain risk during setup. In a setup script that users are likely to run locally with broad system access, this is more dangerous because it directly downloads and executes remote package code before producing artifacts.
The second npx playwright call also executes package-provided code without ensuring a fixed, preinstalled version is used, so behavior may drift and a compromised or unexpected package version could run during dependency installation. Because this command installs browser/system components, compromise here can have broad host impact in the context of a developer setup script.
The script uses sudo apt-get update and sudo apt-get install, which performs privileged system modification from a convenience setup script. Even if intended to help the user, embedding root-level package installation in an agent skill increases blast radius if the script or its dependencies are tampered with, especially since it also installs network-fetched components.
else
echo " ffmpeg not found — attempting install..."
if command -v apt-get &> /dev/null; then
sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg
elif command -v brew &> /dev/null; then
brew install ffmpeg
elif command -v dnf &> /dev/null; then
sudo dnf install -y ffmpeg performs privileged package installation directly from the script, enabling root-level system changes in an automated workflow. In the context of a post-coding proof/demo skill, this functionality is not core to recording proof and therefore expands risk unnecessarily relative to the feature's purpose.
elif command -v brew &> /dev/null; then
brew install ffmpeg
elif command -v dnf &> /dev/null; then
sudo dnf install -y ffmpeg
elif command -v pacman &> /dev/null; then
sudo pacman -S --noconfirm ffmpeg
else
Using --noconfirm removes an interactive safety check and causes package installation to proceed automatically, reducing user awareness and increasing the chance of unintended system changes. In a skill setup script, autonomous package manager actions are riskier because users may run them as part of an agent workflow without carefully reviewing each privileged side effect.
elif command -v dnf &> /dev/null; then
sudo dnf install -y ffmpeg
elif command -v pacman &> /dev/null; then
sudo pacman -S --noconfirm ffmpeg
else
echo " ⚠ Could not install ffmpeg automatically. Install manually for mp4 conversion."
echo " Video recording still works (produces .webm without ffmpeg)."
sudo pacman -S --noconfirm ffmpeg combines root privilege with unattended package installation, making it easy to alter the host system without meaningful user review. This is especially concerning in an agent-driven setup path where commands may be triggered as part of automation and users may not realize they are authorizing privileged changes.
elif command -v dnf &> /dev/null; then
sudo dnf install -y ffmpeg
elif command -v pacman &> /dev/null; then
sudo pacman -S --noconfirm ffmpeg
else
echo " ⚠ Could not install ffmpeg automatically. Install manually for mp4 conversion."
echo " Video recording still works (produces .webm without ffmpeg)."
The dependency uses a caret range instead of an exact version, which allows different package versions to be installed over time. In a security-sensitive automation skill that records proofs and may run in CI, this reduces build reproducibility and can silently pull in vulnerable or behavior-changing releases.
"license": "ISC",
"type": "commonjs",
"dependencies": {
"playwright": "^1.58.2",
"yaml": "^2.8.2"
}
}
Playwright has a referenced advisory involving browser downloads without authenticity verification, and the manifest does not pin a precise version, so it is impossible to verify whether installations are affected. In this skill's context, Playwright is directly relevant to automated browser recording and may fetch browser binaries during setup, making supply-chain and integrity issues more consequential than in a passive library.
The yaml dependency is not pinned to a single exact version, so installs may vary between environments and time. Because YAML parsers often process untrusted or semi-trusted configuration data, drifting to a newly introduced vulnerable version can create avoidable exposure.
"type": "commonjs",
"dependencies": {
"playwright": "^1.58.2",
"yaml": "^2.8.2"
}
}
The yaml package has known advisories, including denial-of-service conditions such as stack overflow or uncaught exceptions, and the unpinned range prevents confirming whether the installed version is safe. If this skill consumes YAML-based configuration or artifacts, malformed input could crash the process or disrupt automation pipelines.
Detected: suspicious.dangerous_exec