T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:153
- Finding
- Unpinned Third-Party CLI Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:153-159`, `references/platforms.md:124-130`, and `references/platforms.md:143-149` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:153-159`: ```bash npx remotion render src/index.ts ReelsVideo out/reels.mp4 npx remotion render src/index.ts FeedPost out/feed-post.mp4 npx remotion render src/index.ts YouTubeVideo out/youtube.mp4 ``` ```bash npx remotion preview src/index.ts ``` `references/platforms.md:124-130`: ```bash # Vertical (Reels, TikTok, YouTube Shorts) npx remotion render src/index.ts ReelsVideo out/reels.mp4 # Square (Instagram feed, Facebook, LinkedIn) npx remotion render src/index.ts FeedPost out/feed-post.mp4 # Landscape (YouTube, LinkedIn, Twitter/X) npx remotion render src/index.ts YouTubeVideo out/youtube.mp4 ``` `references/platforms.md:143-149`: ```bash npx remotion render src/index.ts ReelsVideo out/reels.mp4 npx remotion render src/index.ts FeedPost out/feed-post.mp4 npx remotion render src/index.ts YouTubeVideo out/youtube.mp4 ``` ### Technical Analysis The documented commands execute `remotion` through `npx` without specifying a package version, requiring a verified local installation, or establishing that dependency resolution is controlled by a committed lockfile. When a compatible local binary is unavailable, `npx` may resolve and download a package from the configured package registry and then execute its code. Consequently, the code executed by these instructions is not fully represented by the audited project. Its effective behavior can change based on registry state, dependency resolution, local configuration, and the version available when the command is run. A compromised upstream package release, registry compromise, or unsafe registry configuration could therefore introduce arbitrary code into the rendering workflow. This is a supp ...[truncated 1782 chars]
- Remediation
- ## Remediation Suggestions 1. Add Remotion to the project as an explicitly version-pinned dependency rather than relying on ad hoc registry resolution: ```bash npm install --save-exact remotion@<reviewed-version> ``` 2. Commit the generated lockfile and require integrity-preserving installation in automated or agent-controlled environments: ```bash npm ci ``` 3. Define package scripts that invoke the lockfile-resolved local binary: ```json { "scripts": { "render:reels": "remotion render src/index.ts ReelsVideo out/reels.mp4", "render:feed": "remotion render src/index.ts FeedPost out/feed-post.mp4", "render:youtube": "remotion render src/index.ts YouTubeVideo out/youtube.mp4", "preview": "remotion preview src/index.ts" } } ``` 4. If `npx` must remain in the documentation, require local-only resolution: ```bash npx --no-install remotion render src/index.ts ReelsVideo out/reels.mp4 npx --no-install remotion preview src/index.ts ``` 5. Pin and review transitive dependencies, use a trusted registry, verify lockfile integrity in CI, and run dependency installation and rendering with minimal filesystem, credential, and network privileges.