ClawHub
Back to skill

Security audit

Skill

Security checks for vulnerabilities and agentic risk

Overview

This Remotion helper is purpose-aligned, but it encourages automatic unpinned npm execution and cloud rendering deployment without clear approval, cost, or cleanup safeguards.

Install only if you are comfortable reviewing commands before execution. Do not let an agent run the npx, npm install, AWS credential, Lambda, Cloud Run, rm -rf, or kill commands automatically; pin package versions, use a lockfile, isolate installs, and use least-privilege short-lived cloud credentials with clear cost and cleanup checks.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:86
Finding

Unpinned Third-Party Packages Are Retrieved and Executed

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:29
  • SKILL.md:86
  • guides/01-installation.md:14
  • guides/01-installation.md:50-72
  • guides/03-advanced-usage.md:4-15
  • guides/03-advanced-usage.md:70
  • troubleshooting.md:13
  • troubleshooting.md:17

Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippets:

SKILL.md:86 and guides/01-installation.md:14:

bash
npx create-video@latest

guides/01-installation.md:50-72:

bash
# Lambda rendering (AWS)
npm install @remotion/lambda

# Google Cloud Run rendering
npm install @remotion/cloudrun

# Caption support
npm install @remotion/captions

# Google Fonts
npm install @remotion/google-fonts

# GIF support
npm install @remotion/gif

# Lottie animation
npm install @remotion/lottie

# Media utilities
npm install @remotion/media-utils

# ElevenLabs speech synthesis
npm install @remotion/elevenlabs

guides/03-advanced-usage.md:4-15:

bash
# Install the Lambda package
npm install @remotion/lambda

# Configure AWS credentials
export AWS_ACCESS_KEY_ID=your_key
export AWS_SECRET_ACCESS_KEY=your_secret
export AWS_REGION=us-east-1

# Deploy the Lambda function and S3 bucket
npx remotion lambda sites create --site-name=my-video
npx remotion lambda functions deploy

guides/03-advanced-usage.md:70:

bash
npx ts-node scripts/batch-render.ts

troubleshooting.md:13-17:

bash
npm cache clean --force
npx create-video@latest

# Or specify a version
npx create-video@4 my-project

Technical Analysis

The documentation directs an AI agent or user to retrieve and execute npm packages without pinning them to exact, reviewed versions. Commands using npx may download and immediately execute a package when a suitable local version is unavailable. The latest distribution tag can resolve to different package co ...[truncated 2514 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace latest, major-only, and unconstrained package references with exact versions that have been reviewed:

    bash
    npx --yes create-video@EXACT_REVIEWED_VERSION
npm install --save-exact @remotion/lambda@EXACT_REVIEWED_VERSION

  2. Declare all required tools and libraries in package.json, generate a lockfile, commit it, and use reproducible installation:

    bash
    npm ci

  3. Invoke locally installed binaries rather than allowing npx to resolve and download missing packages dynamically:

    bash
    npm exec --offline -- remotion studio
npm exec --offline -- remotion lambda functions deploy

  4. Pin transitive dependency resolutions through the lockfile and review lockfile changes before upgrades.

  5. Verify package provenance, publisher identity, registry source, integrity metadata, and lifecycle scripts before approving a new version.

  6. Consider disabling installation scripts during dependency acquisition where compatible:

    bash
    npm ci --ignore-scripts

    Any required scripts should then be reviewed and run explicitly.

  7. Run package installation and rendering in an isolated, non-privileged environment with restricted filesystem and network access.

  8. Use short-lived AWS credentials with least-privilege IAM policies. Do not expose broad or long-lived credentials to package installation processes.

  9. Separate dependency installation from cloud deployment so that an npm lifecycle script cannot automatically inherit deployment credentials.

  10. Add an automated dependency review process, vulnerability scanning, and controlled update policy for every pinned version change.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (65)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill promotes AWS Lambda and Cloud Run large-scale rendering but does not warn that these actions can create cloud resources, incur charges, consume quotas, or change deployment state. In an agent setting, omission of those warnings can cause unintended cost and infrastructure impact even without malicious intent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The skill instructs use of npx create-video@latest, which fetches and executes the latest package version at runtime rather than a pinned, reviewed version. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, the agent may execute untrusted code on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow directs the AI to initialize projects, install dependencies, render outputs, and configure cloud deployment without any safety checkpoints or user warnings. This encourages the agent to perform environment-changing and potentially billable actions automatically, which is risky in a hands-off execution context.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

npx remotion studio executes the package resolved from the current environment, and when presented as a generic npx command without version guidance it encourages runtime execution of potentially unpinned code. In an agent context, this increases the chance of executing unexpected or compromised package contents.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

npx remotion render has the same supply-chain exposure as other unpinned npx invocations because it may download and execute code at runtime. Since rendering workflows often run in CI or automation, compromise could affect developer systems or build infrastructure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The capability statement again authorizes npx create-video@latest, normalizing execution of the newest upstream release without review. Repetition in capability sections makes agent auto-execution more likely and amplifies the supply-chain risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The declared AI capabilities include running local commands and deploying AWS Lambda rendering services but omit warnings about side effects, permissions, cloud charges, and system changes. Capability statements can be treated as authorization by an agent, so missing safeguards materially increase operational risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill claims the AI can start Remotion Studio using an unpinned npx remotion studio command. In an automated environment, this can trigger download and execution of unreviewed package code, exposing the host to compromise if the package or dependency chain is malicious.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The render capability relies on npx remotion render without version pinning, preserving the same risk of runtime package resolution and execution. Because render commands may process local files and credentials in developer environments, exploitation impact can extend beyond the project itself.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The quick-start example repeats npx create-video@latest, directly teaching a supply-chain-unsafe execution pattern. Example sections are especially risky because they are likely to be copied verbatim by users or agents.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The example npx remotion studio remains unpinned and may execute code resolved at runtime. In a skill intended for agent use, that pattern can lead to unsupervised execution of changing upstream code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The render example uses unpinned npx remotion render, exposing users to the same remote package execution risk. Because output rendering may be run in automation, this can become an attack path into CI runners or developer hosts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The GIF render example again depends on unpinned npx remotion render, continuing the pattern of runtime execution of mutable upstream code. Multiple repeated instances increase the probability that an agent or user will run at least one unsafe command.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The entire guide is written only in Chinese and does not indicate that other languages are available or that Chinese is required for a region-specific reason. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The documentation instructs users to run npx create-video@latest, which fetches and executes the latest remote package version at runtime. This creates a supply-chain risk because a compromised upstream package, malicious publish, or breaking change could execute arbitrary code on the user's machine without prior review.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

Running npx remotion studio without pinning a version can cause npx to resolve and execute whatever package version is available, including unexpected or compromised releases if the package is not already installed locally. In installation documentation, this exposes users to unnecessary remote code execution and reproducibility risks.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The version check command npx remotion --version may download and execute an unpinned package if no local dependency is present. This is a classic package-execution supply-chain issue because a user may believe they are only querying a version while actually running arbitrary install-time and runtime code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The unpinned npx remotion studio command in the verification section carries the same risk of fetching and executing a remote package version at runtime. Because this appears as a validation step, users may run it reflexively, increasing the likelihood of exploitation if the upstream package is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The render test command npx remotion render ... can execute an unpinned remote package version, exposing users to arbitrary code execution through the npm supply chain. Since render commands are likely to be used in CI or automated workflows, the blast radius can extend beyond a single developer workstation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The checklist again references npx create-video without a fixed version, reinforcing unsafe execution of the latest remotely resolved package. Repetition in a checklist increases the chance that automation agents or users will follow the command verbatim without applying safer controls.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The checklist item referencing npx remotion studio repeats the same unpinned package execution pattern. In context, this is somewhat more dangerous because the guide explicitly says AI can automatically execute the setup flow, which could lead agents to run remote code with little human review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This guide forces a specific language/locale for all users by presenting all instructional content in Chinese only. Under the policy, language constraints should either provide user choice or be clearly documented as a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The documentation instructs users to run npx remotion without pinning a specific version. npx may fetch the latest package at execution time, which creates a supply-chain risk: users can unexpectedly execute newly published or compromised code instead of a reviewed version. In a quickstart guide, this is especially relevant because readers are likely to copy-paste commands directly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This command uses npx remotion without an exact version, so execution may resolve to whatever version is current at runtime. That exposes users to dependency drift and potential malicious package publication or compromise, which is a real supply-chain concern for copy-pasteable setup documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The guide references npx remotion without version pinning, allowing npx to fetch and execute an unpinned package version. If the upstream package or distribution path is compromised, readers may run unintended code, making this a genuine though moderate documentation-level security issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.