Skills/skills.sh/remotion-best-practices

remotion-best-practices@4.0.537

BLOCKED

Publisher claims: "Router for all Remotion skills" Observed in sandbox: static analysis only — behavior not yet observed.

Registry skills.shPublisher remotion-dev · joined 4 days agoInstalls 683KLast detonated 4d ago
WatchDispute verdict

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-10-22 and scored it 45/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

CRITICAL
Access to sensitive file pathsremotion-maps/techniques/mapbox/TECHNIQUE.md:66 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsremotion-maps/techniques/maptiler/references/map-data-sources.md:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsremotion-create/REFERENCE.md:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageSKILL.md:56 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageremotion-captions/import-srt-captions.md:20 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageSKILL.md:73 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageremotion-captions/display-captions.md:20 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsremotion-maps/techniques/mapbox/TECHNIQUE.md:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsremotion-maps/techniques/cesium/assets/CesiumFlythrough.tsx:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageSKILL.md:48 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsremotion-maps/techniques/cesium/assets/CesiumFlythrough.tsx:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageSKILL.md:93 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsremotion-maps/techniques/maptiler/assets/RiverReveal.tsx:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageSKILL.md:88 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsremotion-maps/techniques/mapbox/TECHNIQUE.md:159 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsremotion-maps/techniques/maptiler/assets/MapTilerVectorElement.ts:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageremotion-markup/effects.md:22 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageremotion-markup/embedding-videos.md:16 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageremotion-markup/REFERENCE.md:307 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageremotion-markup/REFERENCE.md:304 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageremotion-markup/audio-visualization.md:13 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageremotion-markup/3d.md:19 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageremotion-markup/audio.md:16 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Unicode escape sequence detectedremotion-markup/arabic-text.md:43 · Unicode escape sequence detected — may contain obfuscated payloads
AST07
HIGH
npx invocation of non-well-known packageremotion-create/REFERENCE.md:36 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageremotion-captions/transcribe-captions.md:11 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageremotion-create/REFERENCE.md:26 · npx invocation of non-well-known package — may execute untrusted code
AST06