Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Remotion video-generation guide that writes project files and runs rendering commands, with no evidence of hidden persistence, exfiltration, or destructive behavior.
Install only if you are comfortable with the agent creating files under an output project directory and running local Remotion rendering commands. Before using optional cloud TTS, cloud Whisper, or callback URLs, confirm what content will be sent to third parties and keep API keys in environment variables.
The skill instructs the agent to write generated source files into output paths without clearly warning that existing files may be created or overwritten. In an agent with write access, this can cause unintended modification or loss of local project data, especially if project names or paths are derived from user input.
The skill directs execution of local rendering commands via exec but does not prominently warn users that a subprocess will be launched. In an agent environment, subprocess execution increases risk because malformed or user-influenced parameters can trigger unintended command behavior, resource exhaustion, or unsafe local actions.
The skill mentions callback URLs and cloud TTS/Whisper services without clearly warning that user prompts, scripts, audio, or transcript data may be transmitted to third parties. This is dangerous because users may unknowingly send sensitive content off-host, creating privacy, compliance, and data exposure risks.
No suspicious patterns detected.
