acestep-simplemv

• Risk level: Low
• Analyzed: Feb 13, 2026, 3:52 AM
• Findings: 0
• Version: 1.0.1

Overview

The skill's code, scripts, and runtime instructions match its stated purpose (rendering music videos with Remotion); nothing in the bundle appears to perform unrelated or covert actions, though it does require local filesystem access, ffprobe, and npm dependency installation which you should be aware of.

This skill appears to do what it claims (Remotion-based music-video rendering). Before using it, note the following: (1) You must run npm install in scripts/ (this will download many packages and native modules). (2) ffprobe/ffmpeg must be installed (the scripts call ffprobe). (3) A Chromium-based browser is required; if none is found the Remotion tooling may attempt to download chrome-headless-shell from upstream servers (network access). (4) When you pass an absolute audio path the CLI copies that audio into the skill's public/ folder (local file duplication). If you are concerned about network or disk writes, run the build in an isolated environment (container/VM) and inspect package.json/package-lock.json before npm install. If you have a restricted network, provide a local browser via BROWSER_EXECUTABLE or the --browser flag to avoid downloads.