video-report
The skill facilitates remote code execution by allowing arbitrary file modification, executing unpinned packages, and downloading untrusted external content for build processes without sufficient security validation.
Skill Info
Install
npx skills add https://github.com/remotion-dev/remotionAssessments (3)
AI Agent Traps ↗The instructions direct the agent to download external content and inject it directly into a source file, followed by executing a build command, creating a high risk of remote code execution if the URL is attacker-controlled.
download the URL and put it as the src in packages/example/src/NewVideo.tsx
The skill uses 'bunx' to execute a package without version pinning, which allows for the execution of arbitrary, potentially malicious code that could change between runs.
bunx remotion render NewVideo --log=verbose
The skill performs arbitrary file modification and command execution based on untrusted user input, creating a significant remote code execution (RCE) risk.
The skill writes user-provided URLs directly into source code and executes `bunx` commands, which could be exploited via command injection if the URL is not sanitized.
Skill body contains no code blocks or usage examples, making it harder for users to evaluate.
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Badge
[](https://mondoo.com/ai-agent-security/skills/github/remotion-dev/remotion/video-report)<a href="https://mondoo.com/ai-agent-security/skills/github/remotion-dev/remotion/video-report"><img src="https://mondoo.com/ai-agent-security/api/badge/github/remotion-dev/remotion/video-report.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/remotion-dev/remotion/video-report.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow