Security audit

Open Animate

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent video-generation helper, but it asks users to run mutable npm and external skill-install commands and use cloud asset generation without enough scoping or privacy notice.

Install only if you are comfortable running the Open Animate and Remotion npm tooling from their current upstream releases. Prefer pinning versions or using a reviewed lockfile, run it in a project sandbox, and avoid sending confidential prompts, media, credentials, or business data through cloud render or AI asset-generation commands unless you have reviewed the providers' handling of that data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Third-Party Packages and External Skill Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description is broadly scoped to 'any visual content' and many common creative tasks, which increases the chance the skill is auto-selected for loosely related requests. Over-broad activation can cause unintended tool use, exposing users to installation, execution, or networked generation paths when a narrower tool or no tool would have sufficed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill metadata instructs installation via npx/npm without any pinned version or integrity control, which means the executed package can change over time or be replaced by a compromised upstream release. Because this is in the install path for a skill, an agent or user following it may execute arbitrary code from the latest registry state.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: npx skills add remotion-dev/skills pulls and executes external package content without pinning to a specific version or commit, creating supply-chain risk. An upstream compromise or unexpected update could cause agents to install and trust altered skill content.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: npx oanim init my-video executes whatever version of oanim is current at invocation time, which exposes users to unreviewed code execution from the npm supply chain. Since initialization commands often write files and run setup logic, compromise here can directly affect the local environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: npx remotion studio similarly relies on an unpinned package version, allowing execution behavior to drift or be subverted by a compromised release. While preview tooling is less inherently dangerous than install scripts, it still runs local code with user privileges.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: npx oanim render executes an unpinned CLI from npm, creating the same supply-chain exposure as other npx invocations. In a rendering workflow, the CLI may access project files, media assets, environment variables, or cloud credentials, increasing the blast radius of a compromised package.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill advertises AI asset-generation commands that send prompts and inputs to external services but does not clearly warn that user content may leave the local environment. In an agent context, this can lead to unintentional disclosure of sensitive prompts, media, or proprietary project details to third-party model providers.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The asset-generation command uses npx oanim without version pinning, so users may execute arbitrary updated registry code while also handling user-supplied prompts and output paths. This combines supply-chain risk with filesystem write capability and potential access to API credentials used by the tool.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This command executes an unpinned oanim binary while invoking an external model and writing output locally, making any upstream package compromise especially impactful. The combination of network access, model inputs, and local file output raises the risk beyond a purely offline helper command.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Like the other npx oanim examples, this unpinned command can execute changing or malicious npm content. Because it processes audio-generation requests and writes media outputs, a compromised tool could exfiltrate prompts, credentials, or alter generated artifacts.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The workflow instructs users to run npx remotion studio, which can resolve and execute an unpinned package version from the registry if the package is not already installed locally. That creates a supply-chain risk: a compromised or unexpected newer release could execute arbitrary code on the user's machine during preview, and the skill context encourages direct CLI execution as part of normal use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.