Paper Collage Remotion

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent local Remotion video workflow, with normal but real dependency and file-output cautions.

Install and render in a dedicated project directory or container. Prefer pinned package versions, a reviewed lockfile, local npm scripts instead of bare npx, and filename-safe prefixes for the sheet-splitting utility.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: assets/remotion-starter/package.json:7

Finding

Unpinned Third-Party Dependencies May Execute Unreviewed Code

Content

View full analysis

--frame=150 --scale=0.25 npx remotion render out/final.mp4 ``` ### Technical Analysis The npm dependencies use caret version ranges, which allow installation of newer compatible releases than the versions represented in the audited source. No committed package lockfile was present in the supplied directory structure, so dependency resolution is not reproducible. The Python installation instruction installs `Pillow` without a version constraint or package hash. In addition, direct `npx remotion` commands may download and execute a package when an appropriate local executable is unavailable. Package installation can execute lifecycle scripts, while CLI invocation directly executes package code. Consequently, the effective code executed by users can differ from the code reviewed during this audit. This finding does not establish that the currently named packages are malicious. It identifies an unsafe dependency-resolution process that leaves execution dependent on mutable external registry state. ### Attack Path 1. An attacker compromises an allowed package release, transitive dependency, or relevant package-registry account. 2. Alternatively, an unexpected or malicious newer version becomes eligible under a caret range. 3 ...[truncated 776 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/split_sheet.py:18

Finding

Unsanitized Output Prefix Allows Writes Outside the Intended Directory

Content

View full analysis

/../outside/target-1.png ``` 4. The path resolves outside `output_dir`. 5. If the destination parent exists and permissions allow it, Pillow writes the generated PNG there and overwrites an existing file of the same name. An absolute-path prefix can similarly cause `output_dir` to be ignored when the final path is constructed. ### Impact Assessment The attacker can cause PNG files derived from the supplied source image to be ...[truncated 388 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad animation-production skill focused on assembling and rendering layered collage-style videos in Remotion. The supplied code does not implement video, animation, or Remotion features. It only performs a specific image-processing task: green-screen style keying of a single image to transparency. While such preprocessing could support layer creation for animations, the code chunk’s actual primary purpose is materially narrower and different from the declared skill behavior, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about authoring or rendering layered paper-cutout/collage animations in Remotion, including motion staging, parallax, captions, narration, and audio effects. The supplied code does none of that. It is a standalone Python script using PIL to read a source image, divide it into grid cells, optionally trim transparency, and save each tile as a PNG. While exporting PNG layers could be tangentially useful in an animation workflow, this code’s primary purpose is asset preprocessing for sprite/image sheets, not creating or rendering Remotion collage animations. Therefore the behavior is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

Using npx remotion studio without pinning a version can cause the environment to fetch and execute whatever package version is current at runtime. That creates a supply-chain risk: a compromised upstream release or unexpected breaking change could execute unreviewed code on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

Using npx remotion still <composition-id> --frame=150 --scale=0.25 without a pinned version allows runtime retrieval and execution of an unpinned package. In a skill intended for media workflows, this is especially relevant because users are being instructed to run the command directly, increasing exposure to upstream package compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

Using npx remotion render <composition-id> out/final.mp4 without version pinning introduces the same supply-chain risk as the other npx invocations. An attacker controlling or compromising the published package or one of its resolved dependencies could gain code execution in the user's environment.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency uses a caret range, which allows newer compatible releases to be installed over time instead of a single audited version. That creates supply-chain drift and can unexpectedly introduce vulnerable or malicious code during future installs, even though the manifest itself does not prove active compromise.

Content

Scanner excerpt · assets/remotion-starter/package.json (reported line 7)May include surrounding context.

json

"render": "remotion render src/index.ts PaperCollageVideo out/final.mp4"
  },
  "dependencies": {
    "@remotion/cli": "^4.0.484",
    "remotion": "^4.0.484"
  },
  "devDependencies": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The remotion dependency is not pinned and is especially relevant here because the package is central to rendering and may process project inputs during video generation. Allowing floating versions increases the chance of pulling in a vulnerable release, and the accompanying advisory note shows there are known serious issues in some remotion versions.

Content

Scanner excerpt · assets/remotion-starter/package.json (reported line 8)May include surrounding context.

json

},
  "dependencies": {
    "@remotion/cli": "^4.0.484",
    "remotion": "^4.0.484"
  },
  "devDependencies": {
    "typescript": "^5.8.3"

Unverifiable Dependency: remotion has 2 known advisory(ies) (CVE-2026-30120 (Remotion: remote code execution (RCE) vulnerability); CVE-2026-30121 (Remotion: arbitrary file write vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The manifest does not pin remotion to a specific version, and remotion has known advisories including reported RCE and arbitrary file write issues. In this skill's context, that is more concerning because the package is used to render media, a workflow that may process untrusted project assets or automation inputs, potentially increasing the blast radius if an affected version is installed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The TypeScript devDependency is also specified with a caret range, so developer and CI environments may resolve different versions over time. While this is less directly exploitable than a runtime dependency, it still weakens build reproducibility and can expose the toolchain to supply-chain issues.

Content

Scanner excerpt · assets/remotion-starter/package.json (reported line 11)May include surrounding context.

json

"remotion": "^4.0.484"
  },
  "devDependencies": {
    "typescript": "^5.8.3"
  }
}

Static analysis

No suspicious patterns detected.