Remotion To Hyperframes

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent migration purpose, but its required validation path can run mutable npm packages and remote browser scripts on the user's machine.

Install only if you are comfortable letting an agent read and rewrite the target Remotion project and run local validation tools. Run the npm/render steps in a clean sandbox or container without unrelated credentials, prefer pinned dependencies and lockfiles, and review generated HTML for external script URLs before rendering or publishing.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: assets/test-corpus/run.sh:128
• Finding: Mutable npm Dependencies Are Installed and Executed Without a Lockfile<![CDATA[ ## Vulnerability Details **File Locations**: - `assets/test-corpus/run.sh:128-135` - `assets/test-corpus/tier-1-title-card/remotion-src/package.json:5-12` - `assets/test-corpus/tier-2-multi-scene/remotion-src/package.json:5-12` - `assets/test-corpus/tier-3-data-driven/remotion-src/package.json:5-14` - `SKILL.md:78-82` **Vulnerability Type**: Unsafe dependency resolution and package execution **Risk Level**: High ### Vulnerable Code The corpus runner installs dependencies from mutable version ranges and subsequently executes the installed Remotion CLI: ```bash if [[ ! -d "$fixture_dir/remotion-src/node_modules" ]]; then echo " ⏳ npm install (first run)" (cd "$fixture_dir/remotion-src" && npm install --silent --no-progress >/dev/null 2>&1) fi echo " ⏳ render Remotion baseline" if ! (cd "$fixture_dir/remotion-src" && \ npx --no-install remotion render "$composition_id" out/baseline.mp4 >/dev/null 2>&1); then ``` The Tier 3 manifest, representative of the mutable dependency declarations, contains: ```json { "name": "tier-3-data-driven-remotion", "version": "0.0.0", "private": true, "scripts": { "render": "remotion render Stargazed out/baseline.mp4" }, "dependencies": { "@remotion/cli": "^4.0.0", "react": "^18.3.1", "react-dom": "^18.3.1", "remotion": "^4.0.0", "zod": "^3.22.0" } } ``` The documented quick path also invokes HyperFrames through `npx` without `--no-install` or an exact package version: ```bash # Render Remotion baseline (after npm install in the fixture) cd remotion-src && npx remotion render <CompositionId> out/baseline.mp4 # Render HF translation cd ../hf-src && npx hyperframes render --output ../hf.mp4 ``` ### Technical Analysis The project does not include lockfiles for the fixture projects, while all dependencies use caret ranges. Running `npm install` can therefore resolve different direct and transitive package versions over time. Standard npm installation also permits dep ...[truncated 1916 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Commit a reviewed `package-lock.json` for each fixture and replace `npm install` with `npm ci`. 2. Pin direct dependencies to exact versions instead of caret ranges. 3. Preserve and verify npm integrity metadata in committed lockfiles. 4. Use `npm ci --ignore-scripts` when dependency lifecycle scripts are not required. 5. If lifecycle scripts are required, explicitly review the scripts and run installation inside a restricted container or sandbox without credentials. 6. Replace `npx hyperframes ...` with a locally installed and lockfile-pinned CLI invocation. 7. Add `--no-install` to all `npx` commands so missing packages cause a failure rather than an implicit download. 8. Run rendering with a minimal environment, read-only source mounts where practical, restricted outbound network access, and no unrelated CI secrets. 9. Add dependency review and vulnerability scanning to changes affecting manifests and lockfiles. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: assets/test-corpus/tier-1-title-card/hf-src/index.html:6
• Finding: HyperFrames Examples Retrieve and Execute Third-Party JavaScript Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Locations**: - `assets/test-corpus/tier-1-title-card/hf-src/index.html:6` - `assets/test-corpus/tier-2-multi-scene/hf-src/index.html:6` - `assets/test-corpus/tier-3-data-driven/hf-src/index.html:6` - `references/lottie.md:27` - `references/lottie.md:60` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Medium ### Vulnerable Code Each rendered HyperFrames fixture retrieves GSAP from a third-party CDN without Subresource Integrity: ```html <!doctype html> <html lang="en"> <head> <meta charset="UTF-8" /> <title>tier-1-title-card</title> <script src="https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.5/gsap.min.js"></script> ``` The Lottie reference similarly recommends remote executable scripts without integrity verification, including an unversioned package URL: ```html <script src="https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.12.2/lottie.min.js"></script> ``` ```html <script src="https://unpkg.com/@lottiefiles/dotlottie-web"></script> ``` ### Technical Analysis A remote `<script>` element grants the retrieved resource execution within the composition's browser context. Although the GSAP and bodymovin URLs contain versions, they do not include an `integrity` attribute, so the browser cannot verify that the received bytes match a reviewed artifact. The unpkg URL does not specify a version at all, allowing the effective implementation to change whenever package resolution changes. Consequently, compromise of the CDN, package publication channel, origin account, DNS or network trust path, or an unversioned package release can replace the reviewed library with arbitrary JavaScript. The effective runtime payload is therefore external to and mutable independently of the audited repository. ### Attack Path 1. An attacker compromises the relevant CDN, upstream package, publishing account, or delivery path. 2. The remote JavaScript response is changed while retaining the expe ...[truncated 1162 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Vendor reviewed GSAP and Lottie runtime files inside the project and load them from local, version-controlled paths. 2. If remote hosting is unavoidable, use exact immutable versions and add Subresource Integrity hashes with `crossorigin="anonymous"`, for example: ```html <script src="https://trusted.example/library.min.js" integrity="sha384-REVIEWED_HASH" crossorigin="anonymous" ></script> ``` 3. Replace the unversioned `@lottiefiles/dotlottie-web` URL with an exact reviewed version. 4. Apply a restrictive Content Security Policy that permits scripts only from approved local paths or explicitly approved origins. 5. Disable outbound network access during deterministic rendering after all required assets have been staged locally. 6. Document and verify cryptographic hashes for vendored browser dependencies. 7. Ensure the rendering browser runs sandboxed, without unrelated credentials, local-file access, privileged extensions, or exposed remote-debugging interfaces. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Even if framed as self-grading, the skill instructs execution of smoke tests, diff generation, and lint checks that go beyond the narrow task users may believe they invoked. In context, this is dangerous because the skill already lacks explicit tool scoping, so hidden or under-declared operational breadth can lead to unnecessary shell execution and file writes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: Even if framed as self-grading, the skill instructs execution of smoke tests, diff generation, and lint checks that go beyond the narrow task users may believe they invoked. In context, this is dangerous because the skill already lacks explicit tool scoping, so hidden or under-declared operational breadth can lead to unnecessary shell execution and file writes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Even if framed as self-grading, the skill instructs execution of smoke tests, diff generation, and lint checks that go beyond the narrow task users may believe they invoked. In context, this is dangerous because the skill already lacks explicit tool scoping, so hidden or under-declared operational breadth can lead to unnecessary shell execution and file writes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Even if framed as self-grading, the skill instructs execution of smoke tests, diff generation, and lint checks that go beyond the narrow task users may believe they invoked. In context, this is dangerous because the skill already lacks explicit tool scoping, so hidden or under-declared operational breadth can lead to unnecessary shell execution and file writes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Even if framed as self-grading, the skill instructs execution of smoke tests, diff generation, and lint checks that go beyond the narrow task users may believe they invoked. In context, this is dangerous because the skill already lacks explicit tool scoping, so hidden or under-declared operational breadth can lead to unnecessary shell execution and file writes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: Even if framed as self-grading, the skill instructs execution of smoke tests, diff generation, and lint checks that go beyond the narrow task users may believe they invoked. In context, this is dangerous because the skill already lacks explicit tool scoping, so hidden or under-declared operational breadth can lead to unnecessary shell execution and file writes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Even if framed as self-grading, the skill instructs execution of smoke tests, diff generation, and lint checks that go beyond the narrow task users may believe they invoked. In context, this is dangerous because the skill already lacks explicit tool scoping, so hidden or under-declared operational breadth can lead to unnecessary shell execution and file writes.

Ae1

High

• Category: analysis-evasion

Content

Run [`scripts/lint_source.py`](scripts/lint_source.py) over the Remotion source directory. The lint detects patterns that can't translate cleanly:

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Read [`references/api-map.md`](references/api-map.md) — the index of every Remotion API and its HF equivalent or per-topic reference. Identify which topic refer

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to read files, write outputs, inspect environment-dependent project state, and execute shell commands, but it declares no explicit tool scope or permission boundary. That creates an overprivileged, ambiguous execution model where the agent may perform filesystem and command actions without a narrowly defined contract, increasing the chance of unsafe or unintended operations.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Do NOT use this skill when:**

- (a) The user is authoring a **new** HyperFrames composition, even if they have or are A/B-testing a similar Remotion video.
- (b) The user mentions Remotion in passing without asking for migration.
- (c) The user shares Remotion code as reference material rather than asking for a translation.
- (d) The user asks for "the same video as my Remotion one" without explicitly asking to migrate the source — treat that as a fresh HyperFrames build.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 81% confidence
• Finding: Using `npx remotion` without a pinned version allows whatever package version resolves at runtime to be executed, which undermines reproducibility and can introduce supply-chain risk. If the environment fetches packages dynamically, a compromised or unexpected version could run arbitrary install or CLI code during skill execution.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 81% confidence
• Finding: Using `npx hyperframes` without an exact version similarly permits execution of an unpinned toolchain component whose behavior may change or be malicious if the package source is compromised. In a skill that already performs rendering and file generation, that can expose the host to arbitrary code execution through the package manager path.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## Translation walk-through

| Remotion                                                      | HyperFrames                                                                                             |
| ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| `<AbsoluteFill style={{ backgroundColor: "#0a0a0a" }}>`       | `<body style="background: #0a0a0a">` + a positioned root div                                            |
| `useCurrentFrame()`                                           | dropped — HF seeks the timeline                                                                         |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The README instructs users to run `npx hyperframes render` without pinning a specific package version. This can fetch and execute whatever version is current at invocation time, creating a supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly. In a skill context, executable setup/render commands are more dangerous because users may copy-paste them directly.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## Translation walk-through

| Remotion                                                            | HyperFrames                                                                                              |
| ------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| `<Sequence from={0} durationInFrames={60}>`                         | `<div data-start="0" data-duration="2" data-track-index="0">`                                            |
| `spring({frame, fps, config: {damping:12, stiffness:100, mass:1}})` | `gsap.to(target, { scale: 1, duration: 0.7, ease: "back.out(1.4)" })`                                    |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The README instructs users to execute `npx hyperframes render` without pinning a specific package version. `npx` may resolve and execute the latest published package, so a compromised, typosquatted, or unexpectedly changed package could run arbitrary code on the user's machine during rendering. In this skill context, the command is presented as a normal workflow step, which increases the likelihood of direct execution by users.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The documentation instructs users to run `npx hyperframes` without pinning an exact package version. `npx` may fetch the latest published package at execution time, which creates a supply-chain risk: a compromised, typosquatted, or unexpectedly changed release could execute arbitrary code on the user's system. In a skill/README context, this is especially relevant because users may copy-paste the command directly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code sends user-provided text to an external API as part of a network request, which can expose potentially sensitive user content to a third party without any visible disclosure, consent flow, or data-minimization control. Even though the request is used to compute metadata, this still creates a privacy and data-handling risk because arbitrary input is transmitted off-box.

External Transmission

Medium

• Category: Data Exfiltration

Content

export const calculateMetadata = async ({ props }: { props: Props }) => {
  const response = await fetch(
    `https://api.example.com/duration?text=${encodeURIComponent(props.text)}`,
  );
  const { durationInFrames } = await response.json();
  return {

• Confidence: 84% confidence
• Finding: This code performs an outbound request to an external domain using user-influenced data, creating a data exfiltration and privacy exposure path. In the context of this skill, the danger is somewhat increased because the skill is specifically supposed to reject async metadata translation blockers, so retaining or reproducing this pattern in translated output could propagate unsupported behavior and external data dependency into generated artifacts.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## Composition root

| Remotion                                             | HyperFrames                                                                                                          |
| ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| `<Composition id durationInFrames fps width height>` | root `<div id="stage" data-composition-id data-start="0" data-duration="<dur/fps>" data-fps data-width data-height>` |
| `defaultProps={...}`                                 | `data-*` attributes on `#stage` (one per scalar prop). Nested objects/arrays — see [parameters.md](parameters.md)    |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| `schema={z.object(...)}`                             | not represented in HTML; the schema lives in the agent's translation step only                                       |
| `calculateMetadata` (sync)                           | resolve at translation time, write concrete values into `data-*`                                                     |
| `calculateMetadata` (async)                          | **refuse + interop** — see [escape-hatch.md](escape-hatch.md)                                                        |
| `registerRoot(RemotionRoot)`                         | drop                                                                                                                 |
| `<AbsoluteFill style>`                               | `<div style="position:absolute;inset:0;{style}">`                                                                    |

## Sequencing

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

See [sequencing.md](sequencing.md) for nesting and stagger details.

| Remotion                                   | HyperFrames                                                                                               |
| ------------------------------------------ | --------------------------------------------------------------------------------------------------------- |
| `<Sequence from={F} durationInFrames={D}>` | `<div data-start="<F/fps>" data-duration="<D/fps>" data-track-index="N">`                                 |
| `<Series>` + `<Series.Sequence>`           | siblings with sequential `data-start` values                                                              |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

See [sequencing.md](sequencing.md) for nesting and stagger details.

| Remotion                                   | HyperFrames                                                                                               |
| ------------------------------------------ | --------------------------------------------------------------------------------------------------------- |
| `<Sequence from={F} durationInFrames={D}>` | `<div data-start="<F/fps>" data-duration="<D/fps>" data-track-index="N">`                                 |
| `<Series>` + `<Series.Sequence>`           | siblings with sequential `data-start` values                                                              |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

See [sequencing.md](sequencing.md) for nesting and stagger details.

| Remotion                                   | HyperFrames                                                                                               |
| ------------------------------------------ | --------------------------------------------------------------------------------------------------------- |
| `<Sequence from={F} durationInFrames={D}>` | `<div data-start="<F/fps>" data-duration="<D/fps>" data-track-index="N">`                                 |
| `<Series>` + `<Series.Sequence>`           | siblings with sequential `data-start` values                                                              |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Static analysis

No suspicious patterns detected.