Remotion Server

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:08 AM UTC
• Version: 1.2.1

Overview

This skill is a disclosed Remotion video project setup and rendering helper, with normal but nontrivial package-installation risks.

Install only if you are comfortable with a skill that can install Linux system browser libraries and npm packages. Prefer running setup and project creation in a non-privileged or disposable development environment, review the generated project before rendering, and pin dependency versions or use a lockfile for more reproducible builds.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/create.sh:38

Finding

Unpinned npm Dependencies Allow Non-Reproducible Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/create.sh, lines 38–41
Vulnerability Type: Unpinned third-party dependencies and unsafe package installation
Risk Level: Medium

Vulnerable Code

bash

npm install --save-exact remotion @remotion/cli @remotion/tailwind > /dev/null 2>&1

# Install dev deps
npm install -D typescript @types/react tailwindcss > /dev/null 2>&1

Technical Analysis

The script resolves npm packages from mutable registry tags without specifying audited version numbers. Although --save-exact records the versions selected for the first group after installation, it does not constrain which versions are initially downloaded. Every execution can therefore resolve a different package version.

The development dependencies are also installed without explicit versions and, by default, are normally saved using semver ranges. No pre-audited lockfile is supplied by the skill before these installations.

npm may execute package lifecycle scripts during installation. Consequently, a compromised new release, compromised maintainer account, malicious transitive dependency, or registry resolution attack could cause attacker-controlled code to execute while create.sh is running. Redirecting all npm output to /dev/null also suppresses warnings and information that could help users detect unexpected package behavior.

Attack Path

1. An attacker compromises a listed npm package, one of its transitive dependencies, or the relevant registry publishing account.
2. The attacker publishes a malicious version that satisfies the mutable tag or dependency range resolved by npm.
3. A user runs scripts/create.sh after that version becomes available.
4. The script downloads the newly resolved package without comparing it against a reviewed lockfile or approved version manifest.
5. npm executes any applicable lifecycle script with the privileges of the user running create.sh.
6. Th ...[truncated 1022 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed version, including development dependencies:

   bash

   npm install --save-exact \
     remotion@APPROVED_VERSION \
     @remotion/cli@APPROVED_VERSION \
     @remotion/tailwind@APPROVED_VERSION \
     typescript@APPROVED_VERSION \
     @types/react@APPROVED_VERSION \
     tailwindcss@APPROVED_VERSION
   

2. Distribute a reviewed package.json and package-lock.json as part of the skill template, then install with:

   bash

   npm ci
   

   This ensures that dependency versions and integrity hashes match the audited lockfile.

3. Regularly scan and review the lockfile with dependency-auditing and software-composition-analysis tooling before updating it.

4. Where package functionality permits, disable lifecycle scripts during installation:

   bash

   npm ci --ignore-scripts
   

   If specific scripts are required, execute only explicitly reviewed setup steps afterward.

5. Do not suppress all installation output. Preserve logs in CI and present npm errors and security warnings to the user.

6. Run project creation in a non-privileged, isolated environment without unrelated credentials or sensitive environment variables.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description emphasizes a rendering capability: headless video rendering on Linux servers using Chrome Headless Shell, with ready-made templates. The supplied code instead creates a new Remotion project directory, initializes npm, installs packages, writes TypeScript/Tailwind/Remotion config files, and generates starter template components. While the templates are loosely consistent with the mention of chat demos/promos, the primary behavior is scaffolding a development project, not rendering videos. There is also no code invoking a render command, configuring Chrome Headless Shell, or handling Linux/headless execution. Therefore the description materially overstates and mischaracterizes what this code chunk actually does.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The README instructs users to run npx remotion render ... without pinning a specific package version. npx may resolve and execute the latest published package if a local dependency is absent, which creates a supply-chain risk: a compromised or unexpectedly changed upstream release could run arbitrary code on the user's system. In this skill context, the command is part of the normal setup flow, so users are likely to execute it directly, increasing practical exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill instructs users to run npx remotion render without pinning an exact package version. npx may fetch the latest package or resolve an unexpected version from the environment, which creates a supply-chain risk and undermines the claim of using Remotion v5 consistently.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

For Ubuntu/Debian:

bash

sudo apt install -y libnss3 libatk1.0-0 libatk-bridge2.0-0 libcups2 libgbm1 libpango-1.0-0 libcairo2 libxcomposite1 libxdamage1 libxfixes3 libxrandr2

Output Formats

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

This command again uses unpinned npx remotion, exposing users to execution of a different package version than intended. In a rendering skill that depends on browser tooling and transitive packages, that increases supply-chain and reproducibility risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The unpinned npx remotion invocation for GIF rendering carries the same supply-chain risk as the other examples. Because this skill encourages repeated copy-paste execution, the lack of version pinning materially increases the chance of unexpected or compromised code being run.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 26)May include surrounding context.

sh

if [[ "$OS" == "ubuntu" ]] || [[ "$OS" == "debian" ]]; then
    echo "📦 Installing browser dependencies..."
    
    # Check for sudo
    if command -v sudo &> /dev/null; then
        SUDO="sudo"
    else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 27)May include surrounding context.

sh

if [[ "$OS" == "ubuntu" ]] || [[ "$OS" == "debian" ]]; then
    echo "📦 Installing browser dependencies..."
    
    # Check for sudo
    if command -v sudo &> /dev/null; then
        SUDO="sudo"
    else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 33)May include surrounding context.

sh

SUDO=""
    fi
    
    $SUDO apt-get update
    
    if [[ "$VERSION" == "24.04" ]]; then
        # Ubuntu 24.04

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 37)May include surrounding context.

sh

SUDO=""
    fi
    
    $SUDO apt-get update
    
    if [[ "$VERSION" == "24.04" ]]; then
        # Ubuntu 24.04

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 54)May include surrounding context.

sh

SUDO=""
    fi
    
    $SUDO apt-get update
    
    if [[ "$VERSION" == "24.04" ]]; then
        # Ubuntu 24.04

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 76)May include surrounding context.

sh

SUDO=""
    fi
    
    $SUDO apt-get update
    
    if [[ "$VERSION" == "24.04" ]]; then
        # Ubuntu 24.04

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.