anything2explainer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:12 AM UTC
• Version: 0.1.0

Overview

The skill appears legitimate for generating explainer videos, but its setup asks users to run mutable, unpinned external code locally without enough containment guidance.

Review this before installing. Use a pinned repository commit, prefer project-local pinned dependencies with a lockfile, avoid global npm installs, and run rendering in an isolated workspace or container without production secrets. Treat batch generation and web research as network- and resource-heavy operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:52

Finding

Unpinned External Repository and npm Dependencies Are Executed Locally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52-73
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

# Prerequisites
npm install -g remotion
npm install

# Clone and setup
git clone https://github.com/Vincentwei1021/anything2explainer.git
cd anything2explainer
npm install

bash

# Generate video from topic
npx remotion render src/index.ts AnyTopic --props '{"topic":"Quantum Computing"}'

# With Chinese content
npx remotion render src/index.ts AnyTopic --props '{"topic":"量子计算简介"}'

# Batch generation
node scripts/batch-generate.js topics.json

Technical Analysis

The installation instructions clone the mutable default branch of an external repository and install npm dependencies without pinning the repository to a reviewed commit. The artifact does not include the referenced repository, package manifest, lockfile, or executable scripts, so the effective code executed by these commands cannot be verified from the audited package.

npm install can execute package lifecycle hooks such as preinstall, install, and postinstall. The global installation of remotion is also unpinned, while npx remotion may retrieve and execute a package if a suitable local executable is unavailable. Consequently, a compromised upstream repository, npm account, transitive dependency, or newly published package version could introduce arbitrary code after this Skill has been reviewed.

The first unqualified npm install is issued before the user enters the cloned repository. If run in an unrelated directory containing a package.json, it could unexpectedly install that project's dependencies and execute its lifecycle scripts.

Attack Path

1. An attacker compromises the referenced GitHub repository, an npm package, a maintainer account, or a transitive dependency.
2. The attacker adds malicious code to repository scripts or an npm l ...[truncated 1095 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the external repository to a reviewed full commit hash rather than cloning and executing its mutable default branch.
2. Supply a committed lockfile and use npm ci instead of npm install to enforce reproducible dependency resolution.
3. Pin direct dependencies to reviewed versions and verify package integrity through the lockfile and trusted registry configuration.
4. Remove the initial npm install that appears before cd anything2explainer, as it may operate on an unrelated working directory.
5. Avoid global package installation. Install Remotion as a pinned project dependency and invoke the local binary using npx --no-install remotion.
6. Review all npm lifecycle scripts and repository scripts before execution. Where compatible, initially install with npm ci --ignore-scripts, audit the required scripts, and enable only those needed.
7. Run rendering and batch-generation commands in an isolated container or restricted user account with no production secrets and minimal filesystem permissions.
8. Document the exact reviewed repository commit, Node.js version, dependency versions, and integrity-verification procedure in SKILL.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad, generic need statements rather than narrow invocation criteria, which increases the chance the skill will activate in unintended contexts. For a skill that can scrape the web, generate files, and consume significant system resources, ambiguous activation can cause unanticipated network access, file creation, or long-running execution when a user only asked for conceptual help.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill advertises web scraping, batch generation, and rendering output but does not clearly disclose that it may perform network requests and create files. This can mislead users about side effects, reducing informed consent and increasing the chance of unexpected data egress, policy violations, storage consumption, or automated processing of untrusted external content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to run npx remotion without pinning a specific package version. npx can fetch and execute package code dynamically, so an upstream compromise, malicious new release, or dependency confusion-style issue could lead to execution of unreviewed code on the user's machine. In this skill, that risk is amplified because the command is presented as a normal usage path rather than an explicitly reviewed installation step.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This usage example again relies on unpinned npx remotion, which may download and execute the latest available package version at runtime. Because this skill targets automated media generation workflows, users may run it repeatedly or in CI-like contexts, increasing the blast radius if a malicious or breaking upstream release is pulled unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The verification step also uses unpinned npx remotion, so even a 'quick test' can trigger execution of newly fetched package code. Verification commands are often run with less scrutiny, making this a realistic supply-chain exposure despite the otherwise legitimate video-rendering context.

Content

No source excerpt is available for this finding.