Remotion Server

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is coherent for creating and rendering Remotion video projects, with user-directed setup that installs normal system and npm dependencies.

This skill appears safe for its stated purpose. Before installing, be prepared for a one-time Linux dependency setup that may require sudo and for project creation to download npm packages. Review generated video content before publishing, as the skill itself recommends.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Running setup can make persistent system package changes on the machine.

Why it was flagged

The setup script may use sudo to install Linux browser dependencies. This is disclosed and purpose-aligned for headless rendering, but it modifies system-level packages.

Skill content

if command -v sudo &> /dev/null; then
        SUDO="sudo"
...
$SUDO apt-get update
...
$SUDO apt-get install -y \

Recommendation

Run the setup only on a Linux system you administer, and review the listed packages before approving sudo prompts.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The generated project depends on packages fetched from the npm ecosystem when the script is run.

Why it was flagged

Project creation downloads dependencies from npm at runtime. This is expected for a Remotion scaffolding tool, but the artifact does not include a lockfile or fixed package versions in the command.

Skill content

npm install --save-exact remotion @remotion/cli @remotion/tailwind > /dev/null 2>&1
npm install -D typescript @types/react tailwindcss > /dev/null 2>&1

Recommendation

Use this in a trusted project directory, review the generated package files, and consider pinning versions or using a lockfile for reproducible builds.