ClawHub
Back to skill

Security audit

Remotion Video Skill (ModelWise)

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Remotion video-creation skill, but installation and bundled Studio/runtime behavior introduce under-disclosed package, network, and project-modification risks.

Install only in an isolated project or container, review or regenerate the lockfile against an approved npm registry, prefer local pinned binaries over unpinned npx commands, and be aware that Remotion Studio/runtime code may edit project files, install packages, start local services, and contact external Remotion or search services.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
package-lock.json:1744
Finding

Dependency Installation Uses a Third-Party Package Registry

Content
View full analysis

Vulnerability Details

File Location: package-lock.json:1744-1749
Vulnerability Type: Supply-chain exposure through a non-official package registry and an installation lifecycle script
Risk Level: Medium

Vulnerable Code

json
"node_modules/esbuild": {
  "version": "0.25.0",
  "resolved": "https://registry.npmmirror.com/esbuild/-/esbuild-0.25.0.tgz",
  "integrity": "sha512-BXq5mqc8ltbaN34cDqWuYKyNhX8D/Z0J1xdtdQ8UcIIIyJyz+ZMKUt58tF3SrZ85jcfN/PZYhjR5uDQAYNVbuw==",
  "hasInstallScript": true,
  "license": "MIT",

The documented installation command that activates dependency installation appears at SKILL.md:44-48:

bash
npm install

Technical Analysis

The lockfile directs npm to download esbuild from registry.npmmirror.com, a third-party registry rather than the official npm registry. Numerous other lockfile entries use the same source. Integrity hashes protect against an artifact differing from the version recorded in the lockfile, but they do not eliminate the risk of a malicious lockfile update or a situation where both the artifact and its recorded hash are compromised.

The exposure is more significant for esbuild because the package is marked with hasInstallScript: true. npm may execute its lifecycle installation logic during npm install, giving downloaded package code access to the installing user's filesystem, environment, and network permissions. The audit did not establish that the current mirrored artifact or its installation script is malicious; the issue is the avoidable supply-chain trust placed in a non-official distribution source.

Attack Path

  1. An attacker compromises the third-party registry, its publishing pipeline, or a future lockfile update.
  2. A malicious package artifact and corresponding integrity value are introduced.
  3. A user follows SKILL.md and runs npm install.
  4. npm downloads the package from the third-party registry.
  5. Th ...[truncated 673 chars]
Remediation
View remediation

Remediation Suggestions

  1. Regenerate package-lock.json using the official npm registry:
    bash
    npm config set registry https://registry.npmjs.org/
rm -rf node_modules package-lock.json
npm install
  2. Review the regenerated lockfile and confirm that every resolved package URL points to an approved registry.
  3. Use npm ci in automated environments so installation strictly follows the reviewed lockfile.
  4. Pin reviewed dependency versions rather than relying on broad ranges where reproducibility is important.
  5. Retain and verify package integrity hashes.
  6. Use npm ci --ignore-scripts in environments where lifecycle scripts are unnecessary. If scripts are required, explicitly inventory and review packages that execute them.
  7. Apply registry allow-listing and outbound network restrictions in CI to prevent unapproved package sources.
  8. Run dependency installation in an isolated, least-privileged build environment without production credentials.

other

Note
Location
build/index.html:19
Finding

Generated Build Artifact Discloses Local Filesystem and Repository Metadata

Content
View full analysis

Vulnerability Details

File Location: build/index.html:19,25
Vulnerability Type: Development metadata information disclosure
Risk Level: Low

Vulnerable Code

At build/index.html:19:

html
<script>window.remotion_cwd = "/Users/leo/Work/Skills/remotion-video-skill";</script>

At build/index.html:25:

html
<script>window.remotion_gitSource = {"name":"PersonalWorkVault","org":"deerleo","ref":"main","type":"github","relativeFromGitRoot":"Skills/remotion-video-skill"};</script>

Technical Analysis

The committed client-readable build artifact embeds the original developer's absolute working directory. This reveals a local username and workstation directory structure. It also exposes repository metadata, including the repository name, organization or account name, branch, hosting platform, and relative project location.

These values are not required for normal video playback and are available to anyone who can obtain or load the build artifact. Although the disclosed data does not itself provide authentication or direct code execution, it gives an attacker reliable reconnaissance information about the developer and source repository layout.

Attack Path

  1. The generated build directory is distributed, published, or hosted.
  2. An attacker retrieves build/index.html.
  3. The attacker reads the window.remotion_cwd and window.remotion_gitSource assignments.
  4. The attacker uses the disclosed username, repository identity, branch, and directory layout to search for related repositories, identify likely maintainers, or create more credible targeted phishing and social-engineering messages.

Impact Assessment

The issue exposes developer and project metadata to unauthenticated recipients of the build artifact. Its direct confidentiality impact is low because no password, token, private key, or other credential was found. The principal risk is improved attacker reconnaissanc ...[truncated 115 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove window.remotion_cwd and window.remotion_gitSource from distributable HTML.
  2. Rebuild production artifacts using a production-oriented Remotion configuration that excludes Studio and development metadata.
  3. Do not publish the generated Studio build directory unless it is necessary for the Skill's operation.
  4. Add a release-stage scan for absolute paths, usernames, repository metadata, source maps, and development-only globals.
  5. Generate release artifacts in an isolated build directory with non-identifying paths.
  6. If repository metadata is required for local development, inject it only into non-distributed development builds.
  7. Purge previously published artifacts or caches containing the disclosed metadata after producing a sanitized build.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (187)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Package installation, codemod-based project modification, keyboard-driven global actions, and external documentation/network requests exceed a narrow 'video template skill' description and introduce meaningful capability to alter local code and reach external services. In an agent context, undocumented code modification and package installation are dangerous because they can change the workspace or import new code without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Package installation, codemod-based project modification, keyboard-driven global actions, and external documentation/network requests exceed a narrow 'video template skill' description and introduce meaningful capability to alter local code and reach external services. In an agent context, undocumented code modification and package installation are dangerous because they can change the workspace or import new code without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Package installation, codemod-based project modification, keyboard-driven global actions, and external documentation/network requests exceed a narrow 'video template skill' description and introduce meaningful capability to alter local code and reach external services. In an agent context, undocumented code modification and package installation are dangerous because they can change the workspace or import new code without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Package installation, codemod-based project modification, keyboard-driven global actions, and external documentation/network requests exceed a narrow 'video template skill' description and introduce meaningful capability to alter local code and reach external services. In an agent context, undocumented code modification and package installation are dangerous because they can change the workspace or import new code without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Package installation, codemod-based project modification, keyboard-driven global actions, and external documentation/network requests exceed a narrow 'video template skill' description and introduce meaningful capability to alter local code and reach external services. In an agent context, undocumented code modification and package installation are dangerous because they can change the workspace or import new code without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Package installation, codemod-based project modification, keyboard-driven global actions, and external documentation/network requests exceed a narrow 'video template skill' description and introduce meaningful capability to alter local code and reach external services. In an agent context, undocumented code modification and package installation are dangerous because they can change the workspace or import new code without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Package installation, codemod-based project modification, keyboard-driven global actions, and external documentation/network requests exceed a narrow 'video template skill' description and introduce meaningful capability to alter local code and reach external services. In an agent context, undocumented code modification and package installation are dangerous because they can change the workspace or import new code without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Package installation, codemod-based project modification, keyboard-driven global actions, and external documentation/network requests exceed a narrow 'video template skill' description and introduce meaningful capability to alter local code and reach external services. In an agent context, undocumented code modification and package installation are dangerous because they can change the workspace or import new code without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Package installation, codemod-based project modification, keyboard-driven global actions, and external documentation/network requests exceed a narrow 'video template skill' description and introduce meaningful capability to alter local code and reach external services. In an agent context, undocumented code modification and package installation are dangerous because they can change the workspace or import new code without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Package installation, codemod-based project modification, keyboard-driven global actions, and external documentation/network requests exceed a narrow 'video template skill' description and introduce meaningful capability to alter local code and reach external services. In an agent context, undocumented code modification and package installation are dangerous because they can change the workspace or import new code without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Package installation, codemod-based project modification, keyboard-driven global actions, and external documentation/network requests exceed a narrow 'video template skill' description and introduce meaningful capability to alter local code and reach external services. In an agent context, undocumented code modification and package installation are dangerous because they can change the workspace or import new code without informed consent.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · build/517.bundle.js (reported line 2157)May include surrounding context.

js
ree',
    'transitions',
    'media-parser',
    'zod-types',
    'zod-types-v3',
    'webcodecs',
    'convert',
    'captions',
    'openai-whisper',
    'compositor',
    'example-videos',
    'whisper-web',
    'media',
    'web-renderer',
    'design',
    'light-leaks',
    'vercel',
    'sfx',
];
exports.extraPackages = [
    {
        name: 'mediabunny',
        version: '1.34.5',
        description: 'Multimedia library used by Remotion',
        docsUrl: 'https://www.remotion.dev/docs/mediabunny/version',
    },
    {
        name: '@mediabunny/ac3',
        version: '1.34.5',
        description: 'AC-3 and E-AC-3 audio codec support for Mediabunny',
        docsUrl: 'https://www.remotion.dev/docs/mediabunny/formats#ac-3-and-e-ac-3',
    },
    {
        name: 'zod',
        version: '4.3.6',
        description: 'TypeScript-first schema validation',
        docsUrl: 'https://zod.dev',
    },
];
exports.descriptions = {
    compositor: 'Rust binary for Remotion',
    player:

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · build/517.bundle.js (reported line 2186)May include surrounding context.

js
lambda: 'Render Remotion videos on AWS Lambda',
    bundler: 'Bundle Remotion compositions using Webpack',
    'studio-server': 'Run a Remotion Studio with a server backend',
    'install-whisper-cpp': 'Helpers for installing and using Whisper.cpp',
    'whisper-web': 'Helpers for using Whisper.cpp in browser using WASM',
    'google-fonts': 'Use Google Fonts in Remotion',
    mcp: "Remotion's Model Context Protocol",
    'media-utils': 'Utilities for working with media files',
    lottie: 'Include Lottie animations in Remotion',
    licensing: 'Manage your Remotion.pro license',
    'layout-utils': 'Utilities for working with layouts',
    'rounded-text-box': 'Create a TikTok-like multiline text box SVG path with rounded corners',
    noise: 'Noise generation functions',
    'motion-blur': 'Motion blur effect for Remotion',
    preload: 'Preloads assets for use in Remotion',
    shapes: 'Generate SVG shapes',
    'zod-types': 'Zod types for Remotion',
    'zod-types-v3': 'Zod 3.22.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · build/517.bundle.js (reported line 9582)May include surrounding context.

js
{
            id: "show-rulers",
            keyHint: null,
            label: "Show Rulers",
            onClick: () => {
              closeMenu();
              setEditorShowRulers((c) => !c);

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · build/517.bundle.js (reported line 9591)May include surrounding context.

js
{
            id: "show-rulers",
            keyHint: null,
            label: "Show Rulers",
            onClick: () => {
              closeMenu();
              setEditorShowRulers((c) => !c);

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · build/517.bundle.js (reported line 50943)May include surrounding context.

js
break;
            }
            if (this.currentTrack.decodingInstructions.some((instruction) => {
              return instruction.data?.type !== "decompress" || instruction.scope !== 1 /* Block */ || instruction.data.algorithm !== 3 /* HeaderStripping */;
            })) {
              console.warn(`Track #${this.currentTrack.id} has an unsupported content encoding; dropping.`);
              this.currentTrack = null;

Whitespace Padding

High
Category
Prompt Injection
Confidence
80% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · build/69.bundle.js (reported line 10406)May include surrounding context.

js
}

;// ./node_modules/zod/v4/locales/index.js

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · build/bundle.js (reported line 1049)May include surrounding context.

js
* @__PURE__ */ (0,jsx_runtime.jsx)(TransitionScene, { transition: "fade", duration: transitionDuration, children: /* @__PURE__ */ (0,jsx_runtime.jsx)(EndScene, {}) }) })
  ] });
};
/* harmony default export */ const compositions_TransitionDemo = ((/* unused pure expression or super */ null && (TransitionDemo)));

;// ./src/compositions/ProductDemo.tsx








const features = [
  { title: "Fast", description: "Lightning fast performance", icon: "\u26A1" },
  { title: "Secure", description: "Enterprise-grade security", icon: "\u{1F512}" },
  { title: "Scalable", description: "Grow without limits", icon: "\u{1F4C8}" }
];
const LogoScene = () => {
  return /* @__PURE__ */ (0,jsx_runtime.jsx)(
    esm.AbsoluteFill,
    {
      style: {
        backgroundColor: "#0a0a0a",
        justifyContent: "center",
        alignItems: "center"
      },
      children: /* @__PURE__ */ (0,jsx_runtime.jsx)(ScaleIn, { duration: 30, useSpring: true, springPreset: "bouncy", children: /* @__PURE__ */ (0,jsx

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High
Category
Supply Chain
Confidence
90% confidence
Finding

browserslist 4.28.1 is reported vulnerable to crashes/prototype writes from untrusted browserslist-stats input and to unbounded memory growth from distinct query inputs. Even if primarily used during build or tooling operations, these are real flaws when attacker-controlled data can reach the library, and the memory growth issue can materially disrupt CI or local rendering workflows. In a video skill with substantial build/render tooling, dependency abuse against the toolchain is plausible.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)

High
Category
Supply Chain
Confidence
95% confidence
Finding

extract-zip 2.0.1 is flagged for arbitrary file write and symlink path traversal issues when extracting crafted archives. This is a serious class of vulnerability because if any workflow in the skill or its dependencies ever extracts attacker-supplied zip content, an attacker may overwrite files outside the intended directory. Remotion's renderer/tooling chain includes this package, so the dependency is relevant even if exploitation depends on actual zip handling paths.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High
Category
Supply Chain
Confidence
80% confidence
Finding

fast-uri 3.1.0 is reported with multiple host confusion and SSRF-related issues around malformed URI parsing and canonicalization. This is a genuine dependency concern, but its practical exploitability depends on whether untrusted URLs are parsed for security decisions in the affected code path. In this package-lock context, it is transitive through schema/validation tooling, so the skill context makes direct exploitation less likely than an application-level URL parser.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High
Category
Supply Chain
Confidence
80% confidence
Finding

nanoid 3.3.11 is flagged for infinite loop and integer wraparound behaviors under invalid size or generator inputs. These are real robustness issues, but they generally require attacker influence over API parameters rather than passive presence of the library. In this skill, nanoid is used transitively via build tooling, which lowers exposure but does not eliminate the supply-chain risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High
Category
Supply Chain
Confidence
91% confidence
Finding

postcss 8.5.6 is reported with issues including arbitrary file read/information disclosure via attacker-controlled source mapping input and XSS in generated CSS output. Because CSS tooling often processes semi-trusted project assets, vulnerabilities in PostCSS can become dangerous in development servers, build pipelines, or any feature that imports external styles/templates. For a Remotion/video creation skill that likely handles rich media and templating assets, this is materially relevant.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: serialize-javascript==6.0.2 — 2 advisory(ies): GHSA-5c6j-r48x-rmvq (Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.to); CVE-2026-34043 (Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like)

High
Category
Supply Chain
Confidence
93% confidence
Finding

serialize-javascript 6.0.2 is flagged for potential remote code execution during serialization of attacker-controlled objects and for CPU exhaustion on crafted inputs. This package is frequently used in bundling/minification pipelines, and unsafe serialization bugs can become severe if untrusted data is ever passed into build-time rendering or template generation. In a content-generation skill with complex build tooling, this is a meaningful risk despite being transitive.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
89% confidence
Finding

ws 8.17.1 is reported vulnerable to uninitialized memory disclosure and memory exhaustion from fragmented frames/chunks. WebSocket bugs are especially relevant when any local dev server, studio server, or renderer control channel exposes a socket endpoint, as Remotion tooling may do. In this skill context, that makes the issue more concerning than a dormant dependency because development and rendering services are part of the expected workflow.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
build/bundle.js:12263

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
build/517.bundle.js:5470

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
build/bundle.js:2173

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
build/517.bundle.js:27972