Security audit

Video Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Remotion video generator, but it exposes local previews publicly and handles environment files, scraping, downloads, and npm execution with insufficient safeguards.

Install only if you are comfortable with the agent scraping public websites through Firecrawl, downloading remote assets, running npm/npx commands, and exposing the local Remotion preview through a public tunnel. Avoid using it in sensitive repositories or directories with untrusted .env files, and require manual approval before scraping non-public URLs or opening any tunnel.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/firecrawl.sh:14
Finding: Arbitrary Shell Execution Through Sourced Environment Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/firecrawl.sh:30
Finding: JSON Request Injection Through Unescaped Website URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/firecrawl.sh:67
Finding: Unrestricted Download of Server-Supplied Asset URLs
Content: View full analysis
&2 curl -sL "$url" -o "$OUTPUT_DIR/$dest" 2>/dev/null || true fi } ``` ```bash IDX=1 while IFS= read -r img_url; do [ -z "$img_url" ] && continue EXT="${img_url##*.}" EXT="${EXT%%\?*}" [ ${#EXT} -gt 4 ] && EXT="png" dl "$img_url" "image-${IDX}.${EXT}" IDX=$((IDX + 1)) done < <(extract_json_array 'data.extract.imageUrls') ``` ### Technical Analysis Asset URLs extracted from externally controlled website content are passed directly to `curl -L`. The implementation does not restrict protocols, destinations, redirects, response size, response type, or download duration. Because redirects are followed, checking only the initial URL would also be insufficient. Depending on curl protocol support and network placement, crafted values may cause requests to loopback, private networks, link-local metadata services, or local resources such as `file://` URLs. Responses are stored under image-like filenames without confirming that they are images. The use of `|| true` and suppressed error output also conceals failed or suspicious downloads. ### Attack Path 1. An attacker controls a website that the Skill is asked to scrape. 2. The page causes Firecrawl to return attacker-selected values in `logoUrl` or `imageUrls`. 3. `firecrawl.sh` extracts these values from the API response. 4. `curl -L` retrieves each value from the Agent's network environment. 5. The response is written into the generated project's public asset directory. 6. Local or internal data may subsequently be exposed through Remotion Studio and the public tunnel. ### Impact Assessment Potential impact includes server-side request forgery against ...[truncated 283 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:35
Finding: Mandatory Public Exposure of an Unauthenticated Development Server
Content: View full analysis
&& npm run dev ``` Wait for "Server ready" on port 3000. 6. **Expose via Cloudflare tunnel** so user can access it: ```bash bash skills/cloudflare-tunnel/scripts/tunnel.sh start 3000 ``` 7. **Send the user the public URL** (e.g. `https://xxx.trycloudflare.com`) ``` The same mandatory behavior is repeated at `SKILL.md:314-317` and tunnel-management commands are documented at `SKILL.md:348-361`. ### Technical Analysis The default workflow requires creating a public tunnel to Remotion Studio. No authentication, authorization, source-IP restriction, explicit user approval, or exposure review is required before publishing the service. Development servers are generally not intended to be security boundaries. The referenced Cloudflare tunnel implementation is not included in this project, so its access-control behavior and cleanup guarantees cannot be verified. ### Attack Path 1. The Agent creates a Remotion project containing generated code and downloaded assets. 2. It starts Remotion Studio on port 3000. 3. It invokes an external tunnel script that publishes the local port. 4. A public URL is generated and shared. 5. Any party that obtains or discovers the URL can attempt to access the development server without an authentication requirement defined by this Skill. 6. Publicly served assets may include content retrieved from internal or otherwise sensitive sources. ### Impact Assessment An unauthorized party may gain access to project previews, static assets, generated content, and any functionality exposed by Remotion Studio. The precise scope depends on the Studio and tunnel configurations, which are outside the supplied audit artifact. ]]>
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: template/package.json:8
Finding: Non-Reproducible npm Installation Without a Lockfile
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/remotion.sh:26
Finding: Unconstrained Project Destination and Unsafe JSON Substitution
Content: View full analysis
}" if [ -d "$PROJECT_NAME" ]; then echo "Error: directory '$PROJECT_NAME' already exists" >&2 exit 1 fi echo "Creating Remotion project: $PROJECT_NAME" cp -r "$TEMPLATE_DIR" "$PROJECT_NAME" # Replace placeholder with actual project name in package.json if command -v sed &>/dev/null; then sed -i'' -e "s/__PROJECT_NAME__/$PROJECT_NAME/g" "$PROJECT_NAME/package.json" fi ``` ### Technical Analysis `PROJECT_NAME` is treated simultaneously as a filesystem path and as raw replacement text in a sed expression that edits JSON. No validation restricts it to a simple package or directory name, so absolute paths and traversal components may select any writable destination. Quotation marks and JSON control characters can corrupt or alter `package.json`. Sed delimiter and replacement metacharacters may also change the intended substitution or cause command failure. Shell quoting prevents ordinary whitespace-based shell injection, but it does not provide path confinement, JSON escaping, or sed replacement escaping. ### Attack Path 1. An attacker influences the project-name argument supplied to `remotion.sh init`. 2. The argument selects an unintended writable destination or contains JSON/sed metacharacters. 3. The template is copied to that location. 4. The raw value is inserted into `package.json`. 5. The generated manifest may be malformed or contain attacker-controlled JSON structure. 6. The workflow subsequently runs npm commands in the generated project, potentially acting on manipulated package configuration. ### Impact Assessment The script can create project files outside the intended output directory wherever the Agent has write permission. Manifest manipulation may disrupt t ...[truncated 212 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This code chunk does not implement an AI video production workflow or any Remotion-based video generation. Its sole behavior is scraping a target website via Firecrawl, extracting brand information and image links, and optionally downloading visual assets such as screenshots, logos, favicons, OG images, and page images. The description does mention FIRECRAWL_API_KEY for website scraping and brand asset extraction, which aligns with this helper script, but the declared primary purpose is video creation. Since the actual code's primary purpose is brand scraping/asset collection and lacks any video-production behavior, this is a material description-to-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code is related to Remotion and video production tooling, so it partially aligns with the general domain. However, the declared description specifically advertises an AI video production workflow and says it requires FIRECRAWL_API_KEY for website scraping and brand asset extraction. This code does none of that: it only wraps Remotion commands for project initialization, rendering, still capture, previewing, listing compositions, and upgrading dependencies. The primary behavior is a local developer utility for Remotion projects, not an AI-driven production workflow with scraping/asset extraction. Therefore the description materially overstates and misrepresents the implemented capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs starting a local dev server and exposing it publicly through a Cloudflare tunnel, then sharing the URL, without any required warning, consent, or access controls. Publicly exposing a development server can leak project contents, enable unauthorized access, and expose the host to risks if the dev server or adjacent resources are misconfigured.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/firecrawl.sh (reported line 7)May include surrounding context.
sh
# # Returns structured brand data + downloads reusable assets (logo, OG image, screenshot). # If output-dir is provided, assets are saved there. Otherwise only JSON is printed. # Requires FIRECRAWL_API_KEY in environment or .env set -euo pipefail

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: The script automatically sources .env files from the workspace, skill directory, and current directory, treating them as executable shell code rather than simple key-value data. If any of those files are attacker-controlled or untrusted, this enables arbitrary command execution and unauthorized access to any secrets defined there, which is especially risky in an agent/workspace context.
Content: Scanner excerpt · scripts/firecrawl.sh (reported line 15)May include surrounding context.
sh
SKILL_DIR="$(dirname "$SCRIPT_DIR")" WORKSPACE_DIR="$(dirname "$(dirname "$SKILL_DIR")")" # Load .env from multiple locations for envfile in "$WORKSPACE_DIR/.env" "$SKILL_DIR/.env" .env; do if [ -f "$envfile" ]; then set -a; source "$envfile"; set +a

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: Using source "$envfile" executes the contents of each discovered .env file in the current shell with exported variables enabled. In this skill context, where repository or workspace files may be influenced by users or other tools, that creates a direct code-execution and secret-loading primitive from untrusted local files.
Content: Scanner excerpt · scripts/firecrawl.sh (reported line 16)May include surrounding context.
sh
WORKSPACE_DIR="$(dirname "$(dirname "$SKILL_DIR")")" # Load .env from multiple locations for envfile in "$WORKSPACE_DIR/.env" "$SKILL_DIR/.env" .env; do if [ -f "$envfile" ]; then set -a; source "$envfile"; set +a fi

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly instructs use of shell commands (bash, npm, curl, npx) but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where a caller may not understand that the skill can execute code and make network requests, increasing the chance of overbroad or unintended command execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger description is broad enough to activate the skill for many generic video-related prompts, which can cause unnecessary shell execution, scraping, dependency installation, or public tunneling in contexts where the user did not intend those actions. In an agent setting, overbroad invocation increases the attack surface and the chance of risky side effects from routine prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill directs website scraping and automatic asset downloads, including curl fetches and Firecrawl usage, without explicit disclosure about network access, third-party processing, or trust of downloaded content. This can lead to unreviewed data exfiltration to external services, collection of copyrighted or sensitive assets, and ingestion of untrusted files into the workspace.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: Using npx remotion without a pinned version allows retrieval or execution of whatever package version resolves at runtime, which can change over time or be compromised upstream. This creates a supply-chain risk and reduces reproducibility of the environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/composition-patterns.md (reported line 136)May include surrounding context.
md
const [handle] = useState(() => delayRender()); useEffect(() => { fetch("https://api.example.com/data") .then((r) => r.json()) .then((d) => { setData(d); continueRender(handle); }); }, []);

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This hard-coded external endpoint confirms the script sends collected target data to a remote SaaS API outside the local trust boundary. In this skill context, external transmission is intentional, but it becomes dangerous if agents can be induced to scrape confidential, intranet, or user-sensitive URLs and exfiltrate their contents through the vendor API.
Content: Scanner excerpt · scripts/firecrawl.sh (reported line 30)May include surrounding context.
sh
exit 1 fi RESPONSE=$(curl -s -X POST 'https://api.firecrawl.dev/v1/scrape' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer ${FIRECRAWL_API_KEY}" \ -d "$(cat <<PAYLOAD

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This hard-coded external endpoint confirms the script sends collected target data to a remote SaaS API outside the local trust boundary. In this skill context, external transmission is intentional, but it becomes dangerous if agents can be induced to scrape confidential, intranet, or user-sensitive URLs and exfiltrate their contents through the vendor API.
Content: Scanner excerpt · scripts/firecrawl.sh (reported line 30)May include surrounding context.
sh
exit 1 fi RESPONSE=$(curl -s -X POST 'https://api.firecrawl.dev/v1/scrape' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer ${FIRECRAWL_API_KEY}" \ -d "$(cat <<PAYLOAD

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The script invokes npx remotion render without pinning a specific package version, so execution may resolve to whatever version is available locally or fetched at runtime. In automation or agent contexts this creates a supply-chain risk: a malicious or compromised package version could be executed unexpectedly, and behavior may change between runs.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The still command also uses unpinned npx remotion, which can download or execute an unexpected package version. Because this wrapper is meant to run code-generation/rendering workflows, any compromised dependency could execute arbitrary code in the user's environment during the render step.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: Running npx remotion compositions without version pinning exposes the workflow to dependency drift and potential malicious package substitution. Even a non-render command still executes package code, so the risk is code execution, not just incorrect output.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The upgrade path calls npx remotion upgrade without an explicit version, which is especially risky because it intentionally changes dependencies and may fetch the latest package code. In an agent skill, this increases supply-chain exposure and can introduce unreviewed changes or malicious code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The package scripts invoke npx remotion without pinning the executable version in the command itself. Although remotion is listed as a dependency, npx may still resolve or fetch an unexpected version depending on environment and tooling behavior, which can introduce supply-chain risk or non-reproducible builds if a compromised or incompatible package is executed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The build script uses npx remotion without version pinning at execution time. In automated or fresh environments this can lead to retrieval or execution of an unintended package version, creating supply-chain exposure and reducing build reproducibility.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The render script executes npx remotion render without explicitly pinning the resolved package version. If the execution environment permits network resolution or falls back to a remote package, an attacker controlling the supply chain or a typo/conflict scenario could cause arbitrary code execution during rendering.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The upgrade script runs npx remotion upgrade without a pinned executable version, which is especially sensitive because upgrade commands modify dependency state. An unexpected or malicious resolved package could alter the project or execute arbitrary code under developer credentials.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.