ClawHub
Back to skill

Security audit

Remotion Best Practice

Security checks for vulnerabilities and agentic risk

Overview

This Remotion guidance skill is mostly coherent documentation, but it should be reviewed because it encourages unpinned package/native downloads and unsafe API-key handling patterns.

Install only if you are comfortable reviewing package commands before running them. Prefer pinned versions and lockfiles, approve remote URLs explicitly, do not paste API keys into chat, and run Whisper/native download workflows in a constrained project environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Package Retrieval and Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:17
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

bash
npx create-video@latest --yes --blank --no-tailwind my-video

Technical Analysis

The setup command explicitly retrieves and executes the mutable latest release of create-video. Because the effective package contents can change after this Skill has been reviewed, subsequent users may execute code that was not included in the audited artifact.

Package CLIs and installation lifecycle scripts execute with the invoking user's permissions. No exact version, lockfile, cryptographic digest, or provenance requirement is specified. This is a supply-chain weakness rather than evidence that the package is currently malicious.

Attack Path

  1. An attacker compromises the package registry account, publication pipeline, or a future create-video release.
  2. The compromised release becomes the package's latest version.
  3. A user or agent follows the Skill and runs the documented command.
  4. npx downloads the mutable release and executes its CLI or lifecycle code.
  5. The compromised code gains the same filesystem, network, and process privileges as the invoking user.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the user's account. The accessible scope may include the current project, other user-readable or user-writable files, environment variables available to the process, and network resources reachable from the development environment. The command does not itself request elevated operating-system privileges.

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed package version.
  • Use a lockfile and a package manager mode that rejects unexpected lockfile changes.
  • Verify package provenance or integrity through trusted registry metadata and published checksums where available.
  • Require explicit user confirmation before downloading and executing a package not already present locally.
  • Run project scaffolding in a restricted container or workspace without unnecessary secrets or access to sensitive directories.
  • Establish a controlled upgrade process that reviews release notes and package changes before updating the pinned version.

T08 · Insecure Dependencies

Warning
Location
rules/transcribe-captions.md:14
Finding

Native Whisper Component Download and Execution Without Documented Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: rules/transcribe-captions.md:14-42
Vulnerability Type: Unsafe third-party and native component installation
Risk Level: Medium

bash
npx remotion add @remotion/install-whisper-cpp
ts
import path from "path";
import {
  downloadWhisperModel,
  installWhisperCpp,
  transcribe,
  toCaptions,
} from "@remotion/install-whisper-cpp";
import fs from "fs";

const to = path.join(process.cwd(), "whisper.cpp");

await installWhisperCpp({
  to,
  version: "1.5.5",
});

await downloadWhisperModel({
  model: "medium.en",
  folder: to,
});

Technical Analysis

The guide instructs the user to install an npm package and then use it to download a native Whisper.cpp component and a model. Whisper.cpp is pinned to version 1.5.5, which reduces version drift, but the npm package installation is not pinned and the guide does not require checksum, signature, or provenance verification for the downloaded native artifacts.

Native components are later executed as part of transcription. Consequently, compromise of the npm package, its download logic, its upstream distribution location, or the retrieved executable could cross the boundary from data retrieval into local code execution.

No evidence indicates that the currently referenced package or Whisper release is malicious. The finding concerns the lack of controls needed to ensure that retrieved components match reviewed artifacts.

Attack Path

  1. An attacker compromises the npm package, its publisher account, its download endpoint, or an upstream artifact distribution mechanism.
  2. A user follows the guide and installs the unpinned package.
  3. installWhisperCpp() retrieves a modified native component without an independently verified digest or signature.
  4. The transcription workflow invokes the downloaded native code.
  5. The modified component executes with the privileges and environm ...[truncated 432 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin @remotion/install-whisper-cpp to an exact reviewed version and commit the resulting lockfile.
  • Verify the Whisper.cpp archive or binary against a trusted cryptographic checksum or signature before execution.
  • Document the expected download host, artifact filename, version, and digest.
  • Fail closed if integrity verification is unavailable or unsuccessful.
  • Require explicit user approval before downloading or running native components.
  • Perform transcription in a sandbox or container with minimal filesystem access, restricted network access, and no unrelated credentials.
  • Review and update the pinned dependency and artifact hashes through a controlled upgrade process.

T09 · Insecure Skill Coding Practices

Warning
Location
rules/calculate-metadata.md:105
Finding

Unrestricted User-Controlled URL Fetching Can Enable Server-Side Request Forgery

Content
View full analysis

Vulnerability Details

File Location: rules/calculate-metadata.md:105-116
Vulnerability Type: Server-side request forgery through an unrestricted URL
Risk Level: Medium

tsx
const calculateMetadata: CalculateMetadataFunction<Props> = async ({
  props,
  abortSignal,
}) => {
  const response = await fetch(props.dataUrl, { signal: abortSignal });
  const data = await response.json();

  return {
    props: {
      ...props,
      fetchedData: data,
    },
  };
};

Technical Analysis

The example passes props.dataUrl directly to fetch() without validating the URL scheme, destination hostname, resolved IP address, port, or redirects. If composition properties can be influenced by an untrusted party and metadata calculation runs in a server-side renderer, the renderer can be induced to make requests from its own network context.

An attacker could target loopback services, private network ranges, link-local services, or cloud instance metadata endpoints. Redirects may also allow an initially permitted public URL to resolve or redirect to a prohibited internal destination. The fetched response is parsed and placed into fetchedData, potentially making internal information observable through rendering output, logs, errors, or subsequent application behavior.

The abortSignal only cancels stale requests; it does not constrain the request destination or mitigate SSRF.

Attack Path

  1. A service accepts composition properties, including dataUrl, from an untrusted caller.
  2. The attacker supplies an internal destination, such as a loopback administration service, private-network API, or link-local metadata endpoint.
  3. calculateMetadata() executes in the rendering environment and calls fetch() using that URL.
  4. The request reaches a resource that is inaccessible directly to the attacker but accessible to the renderer.
  5. The response is parsed and assigned to `fetc ...[truncated 602 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not accept arbitrary URLs when a fixed or allowlisted endpoint can satisfy the use case.
  • Parse URLs with a standards-compliant URL parser and permit only required schemes, normally HTTPS.
  • Maintain an explicit allowlist of trusted hosts and ports.
  • Resolve hostnames and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6.
  • Disable redirects or validate the destination again after every redirect.
  • Protect against DNS rebinding by validating resolved addresses and controlling the actual connection destination.
  • Apply strict connection, response, and overall timeouts, plus maximum response-size limits.
  • Validate response content types and schemas before storing data in composition properties.
  • Run renderers with outbound network restrictions that permit access only to required services.

T09 · Insecure Skill Coding Practices

Warning
Location
rules/voiceover.md:14
Finding

Instruction to Request an API Key May Cause Credential Disclosure in Chat

Content
View full analysis

Vulnerability Details

File Location: rules/voiceover.md:14-16
Vulnerability Type: Unsafe secret collection guidance
Risk Level: Medium

md
By default this guide uses **ElevenLabs** as the TTS provider (`ELEVENLABS_API_KEY` environment variable). Users may substitute any TTS service that can produce an audio file.

If the user has not specified a TTS provider, recommend ElevenLabs and ask for their API key.

Technical Analysis

The guide tells the agent to ask the user for an API key without requiring a secure secret-entry channel. In an AI-agent context, users may respond by pasting the credential directly into the conversation. Such a secret can then be retained in conversation history, application telemetry, debugging logs, or other systems that process agent messages.

The subsequent API example reads the credential from process.env.ELEVENLABS_API_KEY and sends it to the named ElevenLabs API. That behavior is consistent with the stated TTS functionality, and no hidden credential destination was identified. The vulnerability is specifically the instruction to solicit the secret through an unspecified channel rather than directing the user to configure it locally.

Attack Path

  1. The Skill is loaded for a voiceover task without an already configured TTS provider.
  2. Following the guide, the agent asks the user for an ElevenLabs API key.
  3. The user pastes the credential into the chat.
  4. The credential is recorded in conversation history, logs, telemetry, support exports, or downstream agent context.
  5. Any unauthorized party or compromised integration with access to those records may recover and misuse the key.

Impact Assessment

Exposure could allow unauthorized use of the victim's ElevenLabs account within the permissions and quota assigned to the key. Potential consequences include consumption of paid API credits, access to provider resources available to that credential, service di ...[truncated 170 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the instruction to “ask for their API key” with instructions to configure the key locally through an environment variable or approved secret manager.
  • Explicitly tell users never to paste API keys into chat, source files, generated code, command history, or logs.
  • Have the agent check only whether ELEVENLABS_API_KEY is present, without reading or displaying its value.
  • Redact secret-bearing headers and environment values from logs and error messages.
  • Use narrowly scoped credentials when the provider supports them, and establish rotation and revocation procedures.
  • Ensure generated scripts fail with a generic missing-secret message rather than printing the supplied credential.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (44)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The phrase 'Use this skills whenever you are dealing with Remotion code' is a very broad invocation condition and does not specify limits, exclusions, or more concrete trigger criteria. In a markdown skill description, this can cause the skill to be invoked in nearly any context mentioning Remotion, increasing unintended activation risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The skill instructs users to run npx create-video@latest, which pulls and executes the latest package version at runtime. Because the version is not pinned, future upstream compromise or breaking changes could lead to unexpected code execution on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly encourages use of remote asset URLs without warning that rendering may fetch external content. In agent or automated environments, this can lead to unintended network access, privacy leakage, or retrieval of untrusted media from third-party servers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The dynamic metadata example performs a live fetch to an external API using a user-influenced identifier, but the skill provides no warning about data sharing, network policy, or trust boundaries. In automated workflows this could disclose identifiers, create dependency on external services, or normalize network access without user consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The example includes an external API endpoint and a fetch() call that transmits props.videoId to a remote service. While illustrative, this models outbound data transmission and can be dangerous in privacy-sensitive or sandboxed environments if copied without understanding the implications.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md
const calculateMetadata: CalculateMetadataFunction<
  MyCompositionProps
> = async ({ props, abortSignal }) => {
  const data = await fetch(`https://api.example.com/video/${props.videoId}`, {
    signal: abortSignal,
  }).then((res) => res.json());

Rp1

Medium
Category
MCP Rug Pull
Confidence
71% confidence
Finding

The command npx remotion studio executes a package via npx without an explicitly pinned version in the instruction. If the package is not already installed locally, npx may fetch and run code determined by the current registry state, creating a supply-chain risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
71% confidence
Finding

The one-frame render example uses npx remotion still without version pinning. This can cause execution of an unvetted package version when resolved remotely, exposing users to supply-chain compromise or inconsistent behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The documentation instructs users to run npx remotion add @remotion/media-utils without pinning an exact package or CLI version. Unpinned npx execution fetches and runs the latest published package at install time, which creates a supply-chain risk: a compromised upstream release, typo/confusion package resolution, or breaking update could execute unintended code on the user's machine.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rules/compositions.md (reported line 93)May include surrounding context.

md
const calculateMetadata: CalculateMetadataFunction<
  MyCompositionProps
> = async ({ props, abortSignal }) => {
  const data = await fetch(`https://api.example.com/video/${props.videoId}`, {
    signal: abortSignal,
  }).then((res) => res.json());

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This finding is a duplicate occurrence on the same line: the example uses npx remotion without a pinned version. Unpinned npx execution can fetch whatever version is current at runtime, increasing exposure to malicious or unexpected package updates and reducing reproducibility.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The npx remotion ffprobe input.mp4 example invokes a package by name without version pinning. If a user runs this command in an environment without a vetted local install, npx may download and execute an unreviewed latest package version, creating a supply-chain execution risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The FFmpeg trimming example again uses npx remotion without an exact version. Because this skill is instructional, users are likely to copy-paste the command directly, which makes the unsafe pattern more operationally significant despite the benign context.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · rules/gifs.md (reported line 63)May include surrounding context.

Control what happens when the animation finishes:

tsx
// Loop indefinitely (default)
<AnimatedImage src={staticFile("animation.gif")} width={500} height={500} loopBehavior="loop" />

// Play once, show final frame

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The documentation instructs users to run npx remotion without pinning a specific package version, which causes execution of whatever version is currently resolved from the registry at runtime. This creates a supply-chain risk: a compromised latest release, typosquatted dependency resolution, or unexpected breaking change could execute unreviewed code on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This is the same unpinned npx remotion usage on line 10 and represents a real supply-chain exposure. Running an unversioned package via npx can execute newly published code outside the protections of a reviewed dependency lock, which is risky even in example commands.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The command npx remotion add @remotion/light-leaks invokes remotion without version pinning, so users may execute whatever version is current at the time they read the docs. In a docs skill focused on developer setup, that makes the issue more relevant because readers are likely to copy-paste the command directly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The documentation instructs users to run npx remotion without pinning a specific package version. This can cause execution of whatever version is currently published or resolved at install time, reducing reproducibility and creating a supply-chain risk if a compromised or unexpected version is fetched.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The documentation instructs users to run npx remotion add @remotion/layout-utils without pinning a specific remotion version. This can cause consumers to execute whatever package version is current at install time, which weakens supply-chain reproducibility and increases exposure if a newly published or compromised version introduces malicious or unsafe behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The documentation instructs users to run npx remotion add @remotion/zod-types without pinning an exact package version. Unpinned transient execution via npx can fetch the latest package version at execution time, which creates supply-chain risk and reduces reproducibility; if the upstream package or one of its dependencies is compromised, users may execute unexpected code on their machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The documentation instructs users to run npx remotion without pinning a specific package version. npx may fetch the latest package version at execution time, which creates a supply-chain risk: users could unknowingly execute newly published or compromised code. In a skill file that provides copy-pasteable shell commands, this is more dangerous because users are likely to execute the command directly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

This command again uses npx remotion without a pinned version, exposing users to the risk of downloading and executing an unexpected or malicious package version at runtime. Because this is framed as operational guidance for media processing, users may trust and reuse it as-is, increasing the chance of unsafe execution in development or CI environments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The instruction npx remotion add @remotion/install-whisper-cpp relies on resolving the latest remotion package at execution time rather than a pinned version. That creates a supply-chain risk: a compromised or malicious newly published version could be fetched and executed by the user, especially because npx may download code on demand. In this skill context, the command is presented as routine setup, which makes the risk more plausible even though the content appears instructional rather than malicious.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The section is explicitly labeled 'Transparent WebM (VP9)' and the preceding CLI and Studio examples both use VP9, but the calculateMetadata example returns defaultCodec: "vp8". This is an active contradiction in the documentation example that could cause users to configure a different codec than the section claims.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.