ClawHub
Back to skill

Security audit

Remotion

Security checks for vulnerabilities and agentic risk

Overview

This is a Remotion guidance skill with examples for video projects; its network and package-install examples are disclosed and fit that purpose.

Installers should understand that copying the examples may add Remotion packages and may cause renders or previews to request remote media, fonts, docs, or transcription services. Prefer local assets or trusted URLs for reproducible renders and privacy-sensitive projects.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Low
Confidence
89% confidence
Finding
The documentation explicitly encourages loading remote images directly via URL but does not mention that doing so causes network requests during preview or render, potentially disclosing IP address, timing, and project usage metadata to third parties. In a media-rendering skill, this is not code execution, but it is a real privacy and supply-chain concern because untrusted or user-supplied URLs can introduce tracking, availability issues, and non-reproducible renders.

Static analysis

No suspicious patterns detected.