WhatsApp video maker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:06 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a real WhatsApp-style video template, but it asks users to run unpinned external commands and globally install another skill.

Install only after reviewing and pinning the external Remotion and skill dependencies, and prefer a project-scoped install over the documented global install. Treat the render helper as a local convenience script and avoid passing path-like output names.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: generate.sh:7

Finding

Execution of Unpinned Third-Party Packages and Skills

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24-28; generate.sh:7-11
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

SKILL.md:24-28:

bash

## Prerequisites

This skill requires the **Remotion Best Practices** skill:

```bash
npx skills add remotion-dev/skills -a claude-code -y -g

text

`generate.sh:7-11`:

```bash
cd "$PROJECT_DIR" || exit 1

echo "🎬 Rendering WhatsApp video..."
npx remotion render WhatsAppDemo "out/${OUTPUT_NAME}.mp4" --concurrency=4

Technical Analysis

The documented installation command invokes the skills package through npx and installs remotion-dev/skills globally without specifying an immutable version or commit. The generation script similarly invokes remotion through npx without an explicit version.

When a package is unavailable locally, npx can retrieve and execute its current registry release. Consequently, the code executed at installation or rendering time may differ from the code that existed when this project was audited. The global and noninteractive flags (-g and -y) further increase exposure by installing the external skill into a shared environment without an explicit confirmation step.

No evidence in the supplied files establishes that these dependencies are currently malicious. The vulnerability is the lack of dependency pinning and reproducible installation controls, which creates a supply-chain execution path if an upstream package, maintainer account, registry entry, or referenced skill repository is compromised.

Attack Path

1. An attacker compromises the publishing account, registry package, repository, or another distribution point associated with skills, remotion, or remotion-dev/skills.
2. The attacker publishes a modified release or changes the external skill source.
3. A user follows the prerequisite instructions or executes generate.sh.

...[truncated 846 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare remotion and all required command-line packages as local project dependencies pinned to reviewed exact versions.
2. Commit and enforce a package-manager lockfile, and use a reproducible installation command such as npm ci.
3. Invoke the locally installed executable rather than allowing npx to retrieve an unspecified current release.
4. Pin remotion-dev/skills to a reviewed immutable commit or content digest rather than a mutable repository reference.
5. Avoid global installation where possible. Install the skill into a project-scoped, isolated directory.
6. Remove -y for security-sensitive installation workflows or provide an explicit review and confirmation step.
7. Apply dependency integrity verification, automated vulnerability scanning, and controlled update review before accepting newer versions.

T09 · Insecure Skill Coding Practices

Note

• Location: generate.sh:3

Finding

Output Directory Traversal Through Unsanitized File Name

Content

View full analysis

Vulnerability Details

File Location: generate.sh:3-14
Vulnerability Type: Path traversal and unintended file overwrite
Risk Level: Low

Vulnerable Code

bash

# Generate a WhatsApp-style video
# Usage: ./generate.sh [output-name]

OUTPUT_NAME=${1:-"whatsapp-video"}
PROJECT_DIR="$HOME/Projects/remotion-test"

cd "$PROJECT_DIR" || exit 1

echo "🎬 Rendering WhatsApp video..."
npx remotion render WhatsAppDemo "out/${OUTPUT_NAME}.mp4" --concurrency=4

if [ $? -eq 0 ]; then
    echo "✅ Video saved to: $PROJECT_DIR/out/${OUTPUT_NAME}.mp4"
    open "$PROJECT_DIR/out/${OUTPUT_NAME}.mp4"

Technical Analysis

The first command-line argument is incorporated into the output path without validation or canonicalization. Quoting the expansion prevents shell metacharacters inside OUTPUT_NAME from being interpreted as separate shell syntax, so this is not a shell-command injection vulnerability. However, quoting does not prevent filesystem traversal.

An output name containing directory separators and parent-directory components, such as ../../target, produces the relative path out/../../target.mp4. After filesystem path resolution, this destination is outside the intended out directory. If the rendering command permits replacing the selected destination, an existing .mp4 file accessible to the invoking user could be overwritten. After a successful render, the script automatically passes the same resolved path to open.

Exploitation requires control over the argument supplied to generate.sh. The path remains constrained by the invoking user's filesystem permissions and always receives the .mp4 suffix.

Attack Path

1. An attacker causes a user or automation process to invoke the script with a traversal-bearing output name, for example:

   bash

   ./generate.sh ../../target
   

2. The script constructs:

   text

   out/../../target.mp4
   

3. The operating sys ...[truncated 892 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat the argument strictly as a base filename and reject all path separators and traversal components.
2. Apply an allowlist such as:

   bash

   if [[ ! "$OUTPUT_NAME" =~ ^[A-Za-z0-9._-]+$ ]] || [[ "$OUTPUT_NAME" == "." ]] || [[ "$OUTPUT_NAME" == ".." ]]; then
     echo "Invalid output name" >&2
     exit 1
   fi
   

3. Create the output directory explicitly and calculate a canonical destination.
4. Verify that the canonical destination remains beneath the canonical $PROJECT_DIR/out directory before rendering.
5. Decide explicitly whether overwriting existing files is allowed. If not, fail when the destination already exists.
6. Remove the automatic open operation or require explicit user confirmation before opening the generated file.
7. Use the render command directly in the conditional so its status is handled safely:

   bash

   if npx remotion render WhatsAppDemo "$DESTINATION" --concurrency=4; then
     echo "Video saved to: $DESTINATION"
   else
     echo "Render failed" >&2
     exit 1
   fi
   

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs users to run npx skills add remotion-dev/skills -a claude-code -y -g without pinning an exact package/version. Because npx resolves and executes code from the package source at runtime, a compromised upstream package, typo-squatted dependency, or unexpected latest-version change could lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The render command uses npx remotion render ... without an explicit pinned version. This means the command may fetch and execute whatever version npx resolves, creating supply-chain risk if the package or one of its dependencies is compromised or if behavior changes unexpectedly between releases.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

This command again relies on unpinned npx remotion, which can execute an unreviewed or changed package version at runtime. In a skill meant to be copied verbatim by users, repeated unsafe installation patterns increase the chance of supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The higher-quality render example also invokes npx remotion without version pinning, preserving the same supply-chain execution risk as the other examples. The context does not mitigate the issue because the skill explicitly encourages users to run these commands directly in their environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation guidance says 'Just describe the conversation' and gives examples like 'Make a chat video showing [conversation],' which are generic everyday phrases rather than narrowly scoped invocation commands. The file does not provide explicit constraints, trigger boundaries, or negative examples to clarify when this skill should or should not activate.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using npx remotion without pinning an exact package version allows the command to resolve and execute whatever version is currently available from the package source or local environment. If the upstream package is compromised, replaced, or unexpectedly changed, this script could execute unreviewed code during video rendering, which is especially relevant because npx may fetch and run packages automatically.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The inline comment 'Chat only - no outro' states the composition excludes an outro, yet the file contains a dedicated EndCard component labeled as an end card. While the exported composition currently renders only ChatScreen, the nearby documentation creates contradictory intent about whether an outro is part of this template's behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.