Security audit

Remotion Cn

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-language Remotion tutorial skill with no bundled executable code, but it repeatedly recommends mutable npm/npx commands users should treat carefully.

Install only if you want Chinese-language Remotion guidance. Before running the copied commands, prefer exact package versions or a lockfile-controlled project, run dependency installation in a clean development environment without unrelated secrets, and be careful with output paths because the sample configuration enables overwriting files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:38
Finding: Unpinned npm and npx Packages Allow Mutable Third-Party Code Execution
Content: View full analysis
Remediation: View remediation
my-video npx create-vite@ my-video ``` 2. Pin exact dependency versions rather than relying on mutable ranges: ```bash npm install --save-exact remotion@ npm install --save-dev --save-exact @remotion/cli@ ``` 3. Include a reviewed `package-lock.json` and recommend `npm ci` for reproducible installation. 4. Review dependency provenance, package ownership, lifecycle scripts, and published integrity information before updating pinned versions. 5. Where feasible, inspect packages without running lifecycle scripts first: ```bash npm install --ignore-scripts ``` Enable required scripts only after review, recognizing that disabling scripts may affect legitimate installation behavior. 6. Apply the same version pinning to every repeated command at `SKILL.md:301,322,331,339`. 7. Run package installation in an isolated, least-privileged development environment without production credentials or unrelated secrets. ]]>

T08 · Insecure Dependencies

Warning

Location: README.md:24
Finding: README Recommends Mutable Package Installation and Execution
Content: View full analysis
Remediation: View remediation
my-video ``` 2. Install exact reviewed versions: ```bash npm install --save-exact remotion@ @remotion/cli@ ``` 3. Commit a lockfile for any maintained example project and direct users to use `npm ci`. 4. Establish a controlled dependency-update process that includes package provenance checks, lifecycle-script review, vulnerability scanning, and testing before changing pinned versions. 5. Advise users to run project-generation and installation commands in a least-privileged, isolated environment without unrelated credentials. 6. Keep README instructions synchronized with the hardened commands in `SKILL.md` so insecure variants are not reintroduced. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (26)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The README instructs users to run npx create-video@latest, which fetches and executes a package at runtime without pinning to a specific reviewed version. If the upstream package is compromised or a breaking change is introduced, users may execute unexpected code during project creation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 82% confidence
Finding: Using npx remotion studio without a pinned version can cause npx to download and execute whichever package version resolves at the time of use. In documentation, this creates a supply-chain execution risk because readers are encouraged to run transient code that may differ from the version they intended to trust.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 82% confidence
Finding: The render command uses npx remotion without version pinning, so users may execute an unreviewed or newly changed package version at render time. This is a supply-chain risk rather than an application bug, but it is still relevant because the README directly instructs execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 82% confidence
Finding: This command repeats the same transient execution pattern: npx remotion may download and run an unexpected version if none is installed locally or resolution changes. In a README, repeated examples reinforce insecure execution habits for end users.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 82% confidence
Finding: The GIF render example also relies on unpinned npx remotion, carrying the same package substitution or compromised-release risk as the other commands. The skill context is developer tooling, so readers are especially likely to copy-paste these commands directly into their shells.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The sample configuration enables overwrite: true, which normalizes destructive replacement behavior without warning users. In a rendering tool that writes user-chosen output files, this can lead to silent loss of existing artifacts or accidental replacement of important files if paths are misconfigured.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description explicitly labels the skill as a Chinese edition, which signals a fixed language/locale expectation. The document consistently presents the skill in Chinese and does not indicate that users may choose another language, which can violate language/locale policy when no opt-in is provided.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The documentation instructs users to run npx create-video without pinning an exact version, which causes code to be fetched and executed from the registry at runtime. If the package is compromised, updated maliciously, or a user resolves to an unexpected version, this can lead to arbitrary code execution on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The npx create-vite command is unpinned and will download and execute the latest matching package version. This exposes users to supply-chain risk if the upstream package or one of its dependencies is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill tells users to run npx remotion render without pinning a version. Because npx can fetch and execute packages dynamically, this creates a supply-chain execution risk, especially in documentation intended for direct copy-paste.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The npx remotion studio example is unversioned and may execute whatever package version is currently resolved from the registry. That increases exposure to malicious or breaking upstream changes and is a common software supply-chain weakness.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Running npx remotion studio unpinned in development mode still executes registry-sourced code and is vulnerable to package compromise or unexpected updates. Skill documentation amplifies this risk because users often copy commands directly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The unpinned npx remotion preview command may retrieve and run a changed or malicious package version. This is a real supply-chain risk rather than a harmless documentation issue because it results in direct execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The production render command uses unpinned npx remotion, which can execute an attacker-controlled package version if the ecosystem is compromised. In a build/render workflow, that could affect developer machines or CI runners.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This npx remotion render example with width/height flags remains vulnerable because the package itself is unpinned. The extra arguments do not mitigate the core risk of remote code execution through a compromised package release.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The GIF render command invokes an unversioned npx remotion, which is a direct software supply-chain exposure. Because rendering commands are often automated, compromise could impact repeatable pipelines and generated artifacts.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The PNG sequence render command uses unpinned npx remotion, again allowing arbitrary code from the latest resolved package version to run. This is a true vulnerability pattern in documentation that promotes direct execution of network-fetched tooling.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Even when passing --config, the command still relies on unpinned npx remotion, so the executable being run is not fixed. That means a compromised or unexpected upstream version could alter build behavior or execute malicious code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The example project generator uses npx create-video without an exact version, which downloads and runs code at execution time. In example sections, users are especially likely to copy-paste these commands, magnifying supply-chain risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This repeated npx create-video example has the same issue: unpinned runtime package execution from the registry. Repetition throughout the skill increases the likelihood that users adopt the unsafe pattern broadly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The education-video scaffold command remains an unpinned npx create-video invocation, carrying the same arbitrary-code execution and supply-chain compromise risk. Multiple affected lines suggest systemic documentation hygiene problems rather than an isolated typo.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes this skill as a Chinese-language Remotion framework for creating videos with React. However, this section adds code that calls the OpenAI API to generate Remotion code, introducing external-network and credential-dependent functionality that is not necessary to explain or implement a video creation framework itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This line declares the skill is adapted for a Chinese environment and community, implying a locale-specific constraint. Because the file does not explain that this restriction is optional or justified by a region-specific requirement, it presents a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description explicitly labels the skill as a Chinese version and the tags include "chinese", indicating a language-specific constraint. There is no accompanying indication that users can choose another language or opt in to this locale, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This markdown file documents commands that write rendered media files to disk, and the later config example explicitly enables overwriting existing files. The README does not warn users that output files may be replaced, which is a user-data-affecting behavior covered by missing warning checks for markdown files.
Content: No source excerpt is available for this finding.