Conversation Video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:17 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a real conversation-video generator, but it should go to Review because it imports code from an unrelated local environment and uses unpinned package execution.

Install only if you are comfortable running local Python, ffmpeg, npm, and Remotion code. Prefer running it in a clean project or sandbox, pin npm and Python dependencies before use, avoid the browser-use virtualenv fallback, and only render trusted transcript/timing manifests.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_audio.py:34

Finding

Cross-Environment Python Module Loading Enables Untrusted Code Execution

Content

View full analysis

Remediation

View remediation

--hash=sha256: ``` 6. Verify the imported module's resolved path and version before use if runtime validation is required. 7. Restrict write permissions on the project virtual environment to its trusted owner. 8. Run media generation in a sandbox with narrowly scoped filesystem and network access. ]]>

T08 · Insecure Dependencies

Note

• Location: assets/remotion-boilerplate/package.json:5

Finding

Unpinned and Unlocked Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ffmpeg_render.py:84

Finding

FFmpeg Filter-Graph Injection Through Untrusted Timing Manifest Fields

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to run local Python scripts, copy files, install npm dependencies, and invoke shell commands, but it does not declare any explicit tool scope or permissions boundary. That mismatch can cause an orchestrator or reviewer to underestimate the skill's capabilities, increasing the chance of unintended file writes or command execution when the skill is selected.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx remotion without pinning a specific version allows the command to fetch and execute whatever package version is current at runtime. This creates supply-chain risk and undermines reproducibility, since a compromised or incompatible upstream release could execute arbitrary code during install or render steps.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The documentation instructs users to run npx remotion without pinning an exact package version. npx may fetch the latest package at execution time, which makes builds non-reproducible and can expose users to a compromised or unexpected upstream release or dependency chain.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The example uses npx remotion without a pinned version for launching the studio. This can cause execution of whatever version is current at the time of use, increasing supply-chain risk if a malicious or breaking release is published.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ffmpeg_render.py (reported line 34)May include surrounding context.

python

def find_ffmpeg():
    for candidate in ["/usr/lib/jellyfin-ffmpeg/ffmpeg", "ffmpeg"]:
        try:
            subprocess.run([candidate, "-version"], capture_output=True, check=True)
            return candidate
        except (subprocess.CalledProcessError, FileNotFoundError):
            continue

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_audio.py (reported line 58)May include surrounding context.

python

def find_ffmpeg():
    for candidate in ["/usr/lib/jellyfin-ffmpeg/ffmpeg", "ffmpeg"]:
        try:
            subprocess.run([candidate, "-version"], capture_output=True, check=True)
            return candidate
        except (subprocess.CalledProcessError, FileNotFoundError):
            continue

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The command uses ffmpeg with '-y', which silently overwrites the destination file if it already exists. In an agent or automation context, this can destroy prior outputs or overwrite unintended files if the output path is mistaken or attacker-influenced, making the skill context somewhat more dangerous because file paths may be programmatically supplied.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ffmpeg_render.py (reported line 196)May include surrounding context.

python

print("Running ffmpeg...")
    print(" ".join(cmd))
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print("STDERR:", result.stderr[-2000:], file=sys.stderr)
        sys.exit(1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The TTS call forces lang="en", which imposes a specific language/locale behavior on all generated audio. The file does not offer a user opt-in or language selection mechanism, and no region-specific justification is documented.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_audio.py (reported line 135)May include surrounding context.

python

ffmpeg, "-y", "-f", "concat", "-safe", "0",
        "-i", concat_file, "-c", "copy", output_path
    ]
    subprocess.run(cmd, check=True, capture_output=True)

    # Report duration
    result = subprocess.run(

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_audio.py (reported line 138)May include surrounding context.

python

subprocess.run(cmd, check=True, capture_output=True)

    # Report duration
    result = subprocess.run(
        [ffmpeg, "-v", "error", "-show_entries", "format=duration",
         "-of", "default=noprint_wrappers=1:nokey=1", output_path],
        capture_output=True, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_audio.py (reported line 153)May include surrounding context.

python

timings = []
    offset = 0.0
    for i, seg in enumerate(segments):
        result = subprocess.run(
            [ffmpeg, "-v", "error", "-show_entries", "format=duration",
             "-of", "default=noprint_wrappers=1:nokey=1", wav_files[i]],
            capture_output=True, text=True

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/remotion-boilerplate/package.json (reported line 6)May include surrounding context.

json

"version": "1.0.0",
  "private": true,
  "dependencies": {
    "@remotion/cli": "^4.0.0",
    "@remotion/tailwind-v4": "^4.0.0",
    "react": "^19.0.0",
    "react-dom": "^19.0.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/remotion-boilerplate/package.json (reported line 7)May include surrounding context.

json

"private": true,
  "dependencies": {
    "@remotion/cli": "^4.0.0",
    "@remotion/tailwind-v4": "^4.0.0",
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "remotion": "^4.0.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/remotion-boilerplate/package.json (reported line 8)May include surrounding context.

json

"dependencies": {
    "@remotion/cli": "^4.0.0",
    "@remotion/tailwind-v4": "^4.0.0",
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "remotion": "^4.0.0",
    "tailwindcss": "^4.0.0"

Unverifiable Dependency: react has 2 known advisory(ies) (CVE-2013-7035 (Cross-Site Scripting in react); GHSA-hg79-j56m-fxgv (Cross-Site Scripting in react)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/remotion-boilerplate/package.json (reported line 9)May include surrounding context.

json

"@remotion/cli": "^4.0.0",
    "@remotion/tailwind-v4": "^4.0.0",
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "remotion": "^4.0.0",
    "tailwindcss": "^4.0.0"
  },

Unverifiable Dependency: react-dom has 1 known advisory(ies) (CVE-2018-6341 (Cross-Site Scripting in react-dom)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/remotion-boilerplate/package.json (reported line 10)May include surrounding context.

json

"@remotion/tailwind-v4": "^4.0.0",
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "remotion": "^4.0.0",
    "tailwindcss": "^4.0.0"
  },
  "devDependencies": {

Unverifiable Dependency: remotion has 2 known advisory(ies) (CVE-2026-30120 (Remotion: remote code execution (RCE) vulnerability); CVE-2026-30121 (Remotion: arbitrary file write vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/remotion-boilerplate/package.json (reported line 11)May include surrounding context.

json

"react": "^19.0.0",
    "react-dom": "^19.0.0",
    "remotion": "^4.0.0",
    "tailwindcss": "^4.0.0"
  },
  "devDependencies": {
    "@types/react": "^19.0.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/remotion-boilerplate/package.json (reported line 14)May include surrounding context.

json

"tailwindcss": "^4.0.0"
  },
  "devDependencies": {
    "@types/react": "^19.0.0",
    "@types/web": "^0.0.166",
    "typescript": "^5.5.0"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/remotion-boilerplate/package.json (reported line 15)May include surrounding context.

json

},
  "devDependencies": {
    "@types/react": "^19.0.0",
    "@types/web": "^0.0.166",
    "typescript": "^5.5.0"
  },
  "scripts": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · assets/remotion-boilerplate/package.json (reported line 16)May include surrounding context.

json

"devDependencies": {
    "@types/react": "^19.0.0",
    "@types/web": "^0.0.166",
    "typescript": "^5.5.0"
  },
  "scripts": {
    "dev": "remotion studio",

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The comment at L137 says the code will 'Report duration', and the command uses the ffmpeg binary discovered earlier, but the arguments -show_entries and -of are ffprobe options rather than normal ffmpeg transcoding behavior. This is an intent/documentation mismatch because the inline documentation implies a valid duration-reporting implementation while the code invokes a tool interface inconsistent with that claim.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.