Vhs Terminal Recorder

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:47 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent guide for using VHS to make terminal recordings, with disclosed cautions around command execution and publishing.

Install from trusted sources, prefer project-scoped installation over global unless you need global availability, and verify VHS tapes before rendering because tape execution can run commands, modify files, use the network, or publish output if explicitly requested.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:29
• Finding: Unpinned Third-Party Installer and Mutable Repository References## Vulnerability Details **File Location**: `README.md`, lines 29-42 **Vulnerability Type**: Supply-chain risk caused by unpinned installer and repository dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add tmchow/agent-skills --skill vhs-terminal-recorder ``` ```bash npx skills add tmchow/agent-skills --skill vhs-terminal-recorder --global ``` ```bash hermes skills install tmchow/agent-skills/vhs-terminal-recorder ``` ### Technical Analysis The documented installation commands do not pin the `skills` npm CLI to an exact reviewed version and retrieve the skill through mutable repository references rather than a verified commit or immutable release artifact. Consequently, the software installed or executed when a user follows these instructions can differ from the content reviewed during this audit. This creates a time-of-check/time-of-use supply-chain gap. The audited files contain no evidence that the current dependencies are malicious; the risk arises because a future compromise or unauthorized upstream change could alter the effective installation payload. In particular, `npx` may download and execute a package when it is not already installed locally. Without an explicit version and integrity verification, execution depends on the package currently resolved by the registry. Similarly, repository-based skill installation can resolve to mutable upstream content unless the installer independently enforces immutable revisions. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the source repository, or another relevant upstream distribution channel. 2. The attacker publishes a malicious version of the installer or modifies the repository content resolved by the unpinned reference. 3. A user follows one of the documented installation commands. 4. The package manager or skill installer retrieves the attacker-controlled version instead of the content rev ...[truncated 1016 chars]
• Remediation: ## Remediation Suggestions 1. Pin the npm CLI to an exact reviewed version, for example by using an explicit version in the `npx` package specification. 2. Pin repository installations to a verified commit hash or immutable, signed release tag where supported. 3. Prefer release artifacts with published SHA-256 checksums or cryptographic signatures, and document the verification procedure. 4. Use package-manager lockfiles and integrity metadata where installation occurs through a managed project. 5. Avoid recommending global installation by default. Prefer project-scoped installation to limit the blast radius. 6. Document the upstream sources that users should expect the installer to contact and advise users to review material changes before upgrading. 7. If the relevant skill managers do not support immutable references, explicitly disclose that limitation and provide a manual installation workflow tied to a verified commit.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The README instructs users to execute `npx skills add ...` without pinning an exact package version. `npx` resolves and executes the package version available at install time, so a compromised upstream release, dependency confusion event, or unexpected breaking update could result in unreviewed code execution on the user's machine. In a skill-installation context, this is more dangerous because the command is explicitly asking users to fetch and run tooling from the network.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: This command again relies on `npx skills` without a pinned version, which means users may execute whatever version is current at the time of invocation. That creates supply-chain risk and makes installations non-reproducible; if the package or its dependencies are compromised, the install step can execute malicious code. Because this README is specifically guiding skill installation, the risk is directly tied to code execution rather than passive documentation.

Static analysis

No suspicious patterns detected.