Security audit
Security checks for vulnerabilities and agentic risk
The skill’s tools fit its video-conversion purpose, with ordinary dependency and private-image precautions and a bug in its comparison images.
Use trusted source projects and reviewed, locked dependency versions. Embedded private images become part of the generated project or video, so review them before sharing. Check individual timestamp snapshots and per-frame comparison results because the comparison strip can repeat one frame. Companion HyperFrames references are needed for some workflows.
Referenced artifact was not completely inspected
frame / fps`), asset paths root-relative. Each Remotion API's equivalent is in `references/api-map.md`.
Without declared permissions the skill's intent is opaque and cannot be validated.
This is a CLI invocation, not an MCP server, but the unpinned-package concern is valid: npx may download and execute a registry-selected version if no suitable local installation exists. A compromised release could execute code with the agent's filesystem and environment access; the referenced plugin execution rules might mitigate this, but their contents are not provided.
Although catalog search is a legitimate migration step, its unpinned npx invocation can resolve and execute an unreviewed package version. The statement that the search works with nothing installed describes catalog availability, not a guarantee that npx will avoid fetching executable code; this is the same supply-chain issue as the snapshot command.
The documented npx hyperframes command does not specify a version; if no suitable local installation exists, npx can fetch and execute a registry-provided package version that was not reviewed with this fixture. A compromised release could execute code with the invoking user's permissions, exposing accessible files and credentials. This is a CLI invocation rather than an MCP server reference, but the underlying supply-chain risk remains relevant because rendering is part of the skill's expected workflow.
The documented npx hyperframes command can download and execute an unpinned package if no suitable local installation exists, exposing the agent's environment to compromised or unexpectedly changed package releases. This is a normal rendering CLI invocation, not evidence of an MCP server or malicious intent, but its inclusion in an executable evaluation workflow creates a supply-chain risk. A locally installed, lockfile-pinned dependency would reduce that risk, but none is established by the provided file.
The documented npx hyperframes command can download and execute an unpinned package version if a suitable local installation is absent, exposing the rendering environment to compromised future releases with the user's permissions. This is a CLI invocation, not an MCP server reference as the finding claims; its legitimate fixture-rendering purpose and possible use of a locked local dependency reduce the concern, but the supplied README does not establish that protection.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
export const calculateMetadata = async ({ props }: { props: Props }) => {
const response = await fetch(
`https://api.example.com/duration?text=%24%7BencodeURIComponent%28props.text%29%7D%60,
);
const { durationInFrames } = await response.json();
return {
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
See [media.md](media.md) for trim, volume ramps, and decoder notes.
| Remotion | HyperFrames |
| -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `<Audio src volume>` | `<audio data-start data-duration data-track-index data-volume src>`
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
|
| -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `<Audio src volume>` | `<audio data-start data-duration data-track-index data-volume src>` |
| `<Audio playbackRate startFrom endAt>` | `data-playback-rate`, `data-trim-start`, `data-trim-end`
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
-------------------- |
| `<Audio src volume>` | `<audio data-start data-duration data-track-index data-volume src>` |
| `<Audio playbackRate startFrom endAt>` | `data-playback-rate`, `data-trim-start`, `data-trim-end` |
| `<Video src>` | `<video playsinline data-has-audio="true" data-start data-duration data-track-index src>` only when the file has an audio stream (check with `ffprobe -v error -select_streams a -
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
|
| `<Video src>` | `<video playsinline data-has-audio="true" data-start data-duration data-track-index src>` only when the file has an audio stream (check with `ffprobe -v error -select_streams a -show_entries stream=codec_type -of csv=p=0 <file>`: non-empty means it has audio) and the source is not `muted` or `volume={0}`; otherwise `muted` instead |
| `<OffthreadVideo>` | `<video>` — HF doesn't need the off-thread variant (uses headless Chrome) |
| `<Img src>` | `<img>`
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
the source is not `muted` or `volume={0}`; otherwise `muted` instead |
| `<OffthreadVideo>` | `<video>` — HF doesn't need the off-thread variant (uses headless Chrome) |
| `<Img src>` | `<img>` |
| `<IFrame src>` | `<iframe>` — HF auto-falls back to screenshot mode for nested iframes
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
|
| `<Img src>` | `<img>` |
| `<IFrame src>` | `<iframe>` — HF auto-falls back to screenshot mode for nested iframes |
| `staticFile("x.png")` | `"assets/x.png"` in the root, `"../assets/x.png"` inside a `compositions/` scene file — copy the file into `hf-src/assets/` next to `index.html`
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
|
| `staticFile("x.png")` | `"assets/x.png"` in the root, `"../assets/x.png"` inside a `compositions/` scene file — copy the file into `hf-src/assets/` next to `index.html` |
| `delayRender()` / `continueRender()` | drop — HF waits on asset readiness via the Frame Adapter pattern |
## Transitions
The detector incorrectly identifies esbuild as an MCP server, but the command does present a conditional dependency supply-chain risk: if esbuild is not installed locally, npx can download and execute an unpinned release with the invoking user's permissions. A compromised release could access project files or credentials. The command is a legitimate build example relevant to this skill, which supports benign intent, but no version or lockfile requirement is stated.
The skill directs the agent to download and inline credential-protected images without requiring authorization to embed them or warning that the generated artifact will contain their contents. Although asset copying is consistent with video migration, embedding private images removes their original access controls and can disclose them if the resulting HTML or output bundle is shared; the excerpt does not establish intentional exfiltration.
The documented npx hyperframes add sdf-iris command can download and execute an unpinned package version with the invoking user's privileges. This is a conditional supply-chain exposure rather than an MCP server configuration issue: the command is relevant to the migration task, but a compromised future release could execute malicious code if the agent follows it.
This executable example repeats the same unpinned package invocation, potentially allowing a newly published package version to run in the user's environment. Its normal use for installing a transition block supports benign intent, but does not eliminate supply-chain risk; nothing in this excerpt establishes that the command launches an MCP server.
The split filters duplicate the entire selected-frame stream rather than assigning a different sampled frame to each row. Consequently, every row contains the first sampled frame pair when ffmpeg emits its single output image, while timestamps.txt lists multiple timestamps. In a skill explicitly intended to verify visual fidelity, this creates a verification blind spot: later rendering defects or unwanted content can go unnoticed despite an apparently comprehensive comparison strip.
The instruction explicitly requires describing the visual “in English” when constructing the catalog query. This imposes a specific natural language without offering a choice or explaining a technical requirement for that restriction.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"render": "remotion render TitleCard out/baseline.mp4"
},
"dependencies": {
"@remotion/cli": "^4.0.0",
"react": "^18.3.1",
"react-dom": "^18.3.1",
"remotion": "^4.0.0"
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"render": "remotion render MultiScene out/baseline.mp4"
},
"dependencies": {
"@remotion/cli": "^4.0.0",
"react": "^18.3.1",
"react-dom": "^18.3.1",
"remotion": "^4.0.0"
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
},
"dependencies": {
"@remotion/cli": "^4.0.0",
"react": "^18.3.1",
"react-dom": "^18.3.1",
"remotion": "^4.0.0"
}
OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.