ClawHub
Back to skill

Security audit

Remotion

Security checks for vulnerabilities and agentic risk

Overview

The skill is a Remotion video-development guide with expected examples for installing packages and loading remote media; no hidden or destructive behavior was found.

This skill is reasonable to install for Remotion work. Before copying commands, review and preferably pin package versions, and only use remote media, Lottie files, and metadata URLs that you trust because renders may contact those hosts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The documentation recommends executing npx remotion add @remotion/three without pinning the package version. npx resolves and may fetch the latest package at execution time, which creates a supply-chain risk: users can receive unexpected or compromised code if the package or one of its transient dependencies is updated maliciously or incompatibly. In a developer guidance skill, this is more dangerous because it is presented as a copy-paste installation command that users are likely to run directly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file includes an example that fetches data from a URL supplied in props before rendering, which can transmit user-provided or system-derived data to an external service. The surrounding description explains the mechanics of the fetch and abort behavior but does not warn about privacy, network access, or trust implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/compositions.md (reported line 117)May include surrounding context.

md
props,
  abortSignal,
}) => {
  const data = await fetch(`https://api.example.com/video/${props.videoId}`, {
    signal: abortSignal,
  }).then((res) => res.json());

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The documentation recommends running npx remotion without pinning a specific package version, which can cause users to execute whatever version is currently published or resolved at install time. In a supply-chain compromise or malicious package update scenario, this increases the risk of fetching and executing unreviewed code on the developer's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The documentation tells users to execute npx remotion add @remotion/google-fonts without pinning the package version. npx may fetch the latest published package at execution time, which creates a supply-chain risk: a compromised or malicious new release could be executed by users following the guide. In a developer-facing skill that encourages direct copy/paste of commands, this risk is more credible because readers are likely to run the command as written.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This installation example again uses npx remotion add @remotion/fonts without a pinned version, causing the executed CLI package to be resolved dynamically. If the upstream package or dependency chain is ever compromised, users may run attacker-controlled code during setup. Because this is instructional content for a build tool, the context increases risk by normalizing execution of unpinned package-manager commands.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · references/gifs.md (reported line 57)May include surrounding context.

Control what happens when the animation finishes:

tsx
// Loop indefinitely (default)
<AnimatedImage src={staticFile("animation.gif")} width={500} height={500} loopBehavior="loop" />

// Play once, show final frame

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The documentation instructs users to run npx remotion without pinning a specific package version, which can cause execution of whatever version is current at install time. If the upstream package or one of its dependencies is compromised, users may execute unexpected code during installation or CLI invocation, making this a real supply-chain risk even though it appears in benign setup guidance.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file includes guidance and sample code that uses fetch() to send a videoId to an external API, but the surrounding text does not disclose that metadata calculation may contact remote services. For markdown files, omissions of warnings about privacy- or data-affecting behavior should be flagged when the described behavior could transmit user data externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation explicitly recommends loading remote images by URL but does not warn that rendering will cause outbound network requests to third-party hosts. In a video rendering context, this can disclose IP address, timing, and potentially sensitive asset-selection patterns, and can reduce build reproducibility if remote assets change or disappear.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.