Morfeo Remotion Style

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:57 AM UTC
• Version: 1.0.0

Overview

This is a narrow Remotion style guide, with the main cautions being unpinned npm setup commands and CDN-loaded emoji images.

Installers should review and preferably pin the npm package versions before running the setup commands, and render in an environment where third-party CDN requests for emoji images are acceptable. The skill otherwise appears limited to branded Remotion video styling and sample UI code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:142

Finding

Unpinned Third-Party Package Execution and Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 142–143
Vulnerability Type: Unpinned npm dependencies and mutable package execution
Risk Level: Medium

Vulnerable Code

bash

npx create-video@latest --template blank
npm i @remotion/google-fonts

Technical Analysis

The documented setup process instructs users to download and execute the current release of create-video through npx ...@latest. The latest tag is mutable, so the code executed at installation time may differ from the version that existed when this Skill was audited.

The subsequent installation of @remotion/google-fonts also omits an exact version. No lockfile is included to provide integrity and transitive-dependency resolution guarantees. Depending on npm configuration and package contents, installation may also execute package lifecycle scripts.

This creates a supply-chain trust boundary in which future package releases, compromised maintainer accounts, or compromised transitive dependencies could introduce code that was not reviewed with this Skill.

Attack Path

1. An attacker compromises a relevant npm publisher account, package release process, or transitive dependency.
2. The attacker publishes a malicious version and causes it to be resolved by the mutable latest tag or unpinned dependency range.
3. A user follows the setup commands in SKILL.md.
4. npx downloads and executes the resolved create-video package with the user's local permissions, or npm runs malicious package code or lifecycle scripts during installation.
5. The malicious code accesses resources available to the invoking process.

This finding does not establish that the currently published packages are malicious; it identifies the unsafe, non-reproducible dependency execution mechanism.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running the setup commands. Depending on that user's environment, the code cou ...[truncated 257 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a reviewed, exact package version:

   bash

   npx create-video@X.Y.Z --template blank
   

2. Pin @remotion/google-fonts to an exact reviewed version rather than allowing mutable resolution:

   bash

   npm install --save-exact @remotion/google-fonts@X.Y.Z
   

3. Commit and review a generated package-lock.json, including resolved package sources and integrity hashes.

4. Use npm ci for repeatable installation after the lockfile has been established.

5. Review the dependency tree and package lifecycle scripts before upgrades. Where compatible with the required workflow, install with lifecycle scripts disabled:

   bash

   npm ci --ignore-scripts
   

6. Perform package setup in a least-privileged, isolated environment without production credentials or unnecessary filesystem access.

7. Use an approved npm registry and enforce dependency provenance, integrity, and package-version policies in CI.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger condition includes broad language such as 'any Remotion video request from Paul,' which can cause the skill to activate outside narrowly intended contexts. Overly broad activation increases the chance that style instructions are injected into unrelated tasks, potentially confusing higher-priority workflows or causing unintended behavior in agent orchestration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code constructs a remote jsDelivr URL and loads it via an tag, which causes the user's browser to make a network request to a third-party CDN. The file contains only an internal comment about the CDN and no user-facing warning, confirmation, or disclosure about the external fetch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This TSX file contains hard-coded Spanish phrases such as "ESTO ES BLACK MIRROR", "Todo el mundo habla de", and "Le mandás un audio y te responde". Under the language/locale policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.