moda-video-demo

The code appears to be legitimate automation for recording browser demos, with no evident malware or intentional data theft in this fragment. However, it contains a real command-injection vulnerability: the user-controlled --name value is interpolated into a bash -c command. A malicious name such as a value containing shell metacharacters could execute arbitrary commands with the process privileges. Replace the shell pipeline with filesystem APIs or validate and safely escape the name. Broad environment propagation and unrestricted --flow file reading are secondary security concerns.

SUSPICIOUS: the skill’s purpose and capabilities mostly align, but it grants high-impact browser automation and depends on an unreviewed bundled `demo-capture` tool whose full provenance and data flows are not verifiable from this material. No direct credential theft or overt exfiltration is shown, but the combination of autonomous app interaction, likely remote publish flows, and opaque bundled code makes this a high security-risk skill rather than benign documentation.

The postinstall script automatically runs Playwright's installer to download and install Chromium browser artifacts. This is not obviously a direct malware payload (no reverse-shell, no explicit exfiltration, no obvious system-destroying rm commands), but it has notable supply-chain and runtime risks: npx invokes package code which executes during install; Playwright's installer downloads large native/browser artifacts and may make network requests; optional SDKs and native binaries increase the attack surface. You should review the package's shipped scripts (e.g., run.mjs, doctor.mjs, any postinstall hooks in dependencies), and be aware that running npx (even for a declared dependency) executes code during install and can be abused if an upstream package is compromised.