T08 · Insecure Dependencies
- Location
SKILL.md:153- Finding
Unpinned Third-Party CLI Execution Through npx
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:153-159,references/platforms.md:124-130, andreferences/platforms.md:143-149
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: MediumVulnerable Code
SKILL.md:153-159:bash npx remotion render src/index.ts ReelsVideo out/reels.mp4 npx remotion render src/index.ts FeedPost out/feed-post.mp4 npx remotion render src/index.ts YouTubeVideo out/youtube.mp4bash npx remotion preview src/index.tsreferences/platforms.md:124-130:bash # Vertical (Reels, TikTok, YouTube Shorts) npx remotion render src/index.ts ReelsVideo out/reels.mp4 # Square (Instagram feed, Facebook, LinkedIn) npx remotion render src/index.ts FeedPost out/feed-post.mp4 # Landscape (YouTube, LinkedIn, Twitter/X) npx remotion render src/index.ts YouTubeVideo out/youtube.mp4references/platforms.md:143-149:bash npx remotion render src/index.ts ReelsVideo out/reels.mp4 npx remotion render src/index.ts FeedPost out/feed-post.mp4 npx remotion render src/index.ts YouTubeVideo out/youtube.mp4Technical Analysis
The documented commands execute
remotionthroughnpxwithout specifying a package version, requiring a verified local installation, or establishing that dependency resolution is controlled by a committed lockfile. When a compatible local binary is unavailable,npxmay resolve and download a package from the configured package registry and then execute its code.Consequently, the code executed by these instructions is not fully represented by the audited project. Its effective behavior can change based on registry state, dependency resolution, local configuration, and the version available when the command is run. A compromised upstream package release, registry compromise, or unsafe registry configuration could therefore introduce arbitrary code into the rendering workflow.
This is a supp ...[truncated 1782 chars]
- Remediation
View remediation
Remediation Suggestions
-
Add Remotion to the project as an explicitly version-pinned dependency rather than relying on ad hoc registry resolution:
bash npm install --save-exact remotion@<reviewed-version> -
Commit the generated lockfile and require integrity-preserving installation in automated or agent-controlled environments:
bash npm ci -
Define package scripts that invoke the lockfile-resolved local binary:
json { "scripts": { "render:reels": "remotion render src/index.ts ReelsVideo out/reels.mp4", "render:feed": "remotion render src/index.ts FeedPost out/feed-post.mp4", "render:youtube": "remotion render src/index.ts YouTubeVideo out/youtube.mp4", "preview": "remotion preview src/index.ts" } } -
If
npxmust remain in the documentation, require local-only resolution:bash npx --no-install remotion render src/index.ts ReelsVideo out/reels.mp4 npx --no-install remotion preview src/index.ts -
Pin and review transitive dependencies, use a trusted registry, verify lockfile integrity in CI, and run dependency installation and rendering with minimal filesystem, credential, and network privileges.
-