video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent video-production guidance, but it tells agents to run mutable third-party npm code and recommends sensitive avatar workflows without enough privacy or provenance guardrails.

Review and pin any npm packages before running the examples, preferably in a clean sandbox with no unrelated secrets. Do not upload employee, customer, or third-party likeness, voice, scripts, or proprietary assets to avatar or video vendors without consent and approval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:59

Finding

Unpinned Hyperframes Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

npm install hyperframes

Technical Analysis

The installation command does not specify an exact reviewed version or require integrity verification. Consequently, the package version resolved when the command is run may differ from the version available during this audit.

By default, npm may execute package lifecycle scripts during installation. If the package, one of its transitive dependencies, its maintainer account, or its distribution channel is compromised, attacker-controlled code could run with the privileges of the user or agent executing the command. The project does not provide a lockfile or documented provenance-verification procedure that would make the resolved dependency graph reproducible.

Attack Path

1. An attacker compromises the hyperframes package, a transitive dependency, or an associated publisher account.
2. The attacker publishes a malicious version that is eligible for resolution by the unpinned command.
3. A user or AI agent follows the instruction in SKILL.md.
4. npm downloads the mutable package release and its dependencies.
5. Malicious lifecycle code executes during installation or malicious library code executes when the package is subsequently imported.
6. The payload accesses or modifies resources available to the invoking process.

Impact Assessment

Successful exploitation could execute arbitrary code with the invoking user's privileges. The accessible scope may include project files, environment variables, local configuration, package-manager credentials, and other resources readable or writable by that account. No privilege-escalation mechanism is present in the audited project, so the impact remains bounded by the permissions and isolation of the installation environment.

Remediation

View remediation

Remediation Suggestions

• Pin Hyperframes to an exact version that has undergone review, rather than relying on the package registry's current default release.
• Commit a package lockfile and use npm ci in automated or agent-operated environments to obtain a reproducible dependency graph.
• Verify package provenance, publisher identity, registry source, and integrity metadata before installation.
• Review package and transitive-dependency lifecycle scripts before permitting them to execute.
• Consider initially installing with lifecycle scripts disabled for inspection, then enable only those scripts demonstrated to be necessary.
• Perform dependency installation and rendering in a restricted container or sandbox without unrelated credentials or sensitive host-directory access.
• Use automated dependency monitoring while requiring explicit review before lockfile updates.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:88

Finding

Execution of a Mutable Latest-Tagged Remotion Initializer

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:88
Vulnerability Type: Unpinned remote package retrieval and execution
Risk Level: High

Vulnerable Code:

bash

npx create-video@latest

Technical Analysis

This command explicitly resolves the mutable latest distribution tag and executes the downloaded package through npx. The effective code therefore can change after the skill has been reviewed without any corresponding modification to the audited project.

Unlike a dependency that is merely declared for later use, this initializer is directly executed. There is no exact version pin, lockfile constraint, integrity value, source review requirement, or sandboxing instruction. A malicious release selected by the latest tag could run arbitrary initializer or lifecycle logic immediately.

This finding is classified as insecure dependency usage because the execution risk originates from a mutable third-party npm package and its supply chain.

Attack Path

1. An attacker compromises the initializer package, one of its dependencies, its publisher account, or the npm distribution path.
2. The attacker publishes a malicious release and causes the latest tag to resolve to it.
3. A user or AI agent follows the documented npx create-video@latest instruction.
4. npx retrieves the currently tagged package and resolves its dependencies.
5. The package's executable or lifecycle scripts run locally with the invoking user's permissions.
6. The payload may read credentials, alter the project, install additional components, or execute other commands allowed in that environment.

Impact Assessment

Successful exploitation provides arbitrary code execution under the account running npx. This may expose the current repository, writable user files, environment variables, development credentials, and network-accessible services available to that process. If the command is run in a privileged or poorl ...[truncated 274 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed version.
• Resolve and inspect the package and dependency graph before execution, including executable entry points and lifecycle scripts.
• Record the approved version and integrity information in project-controlled configuration and a lockfile where supported.
• Avoid direct execution of mutable registry content in agent or CI workflows.
• Run the initializer in an ephemeral, least-privileged container with no unrelated secrets, host credentials, or broad filesystem mounts.
• Restrict outbound network access during execution unless it is explicitly required.
• Review generated files and filesystem changes before moving them into the trusted project workspace.
• Require explicit approval for version upgrades instead of automatically following a mutable distribution tag.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation description includes broad triggers like 'create, generate, or produce video content' and especially 'make me a video,' which are common natural-language requests that could match many contexts. The description does not provide exclusion conditions or negative examples beyond routing two adjacent domains, so the trigger scope remains relatively broad for a markdown skill definition.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill recommends executing npx create-video@latest, which fetches and runs remote package code without pinning to a specific trusted version. In an agent-facing skill, this increases supply-chain risk because future package changes, compromise of the package/publisher, or dependency hijacking could cause unreviewed code execution on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill encourages use of third-party API video and avatar services, including custom avatar creation from a user's likeness, without any privacy or consent warning. This is risky because users may share scripts, proprietary assets, recordings, or biometric-like facial/voice data with external vendors without understanding retention, training, transfer, or consent implications.

Content

No source excerpt is available for this finding.