Versioned security assessment

Report ID: SA-3BB1B553

5/30/2026, 8:56:48 AM

remotion-render security assessment v1

Skill Security Certification Report

Audit History
Audit model: claude Historical report
Skill name
remotion-render
Version
v1
Maintainer
skills-shell
Source
github.com/skills-shell/skills/tree/main/tools/video/remotion-render/
Coverage
1 Files scanned · 213 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis flagged 41 potential issues, but evaluation reveals all HIGH and MEDIUM findings are false positives. The scanner misidentified markdown code fences as Ruby backtick execution and YAML frontmatter as cryptographic algorithms. LOW findings are legitimate hardcoded URLs to the inference.sh service. This is a legitimate video rendering skill that wraps the belt CLI tool to call inference.sh's Remotion rendering API. Risk factors are confined to the expected belt tool usage and network calls required for core functionality.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 213 Lines analyzed

1 item shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 6 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 9 evidence locations

Capability review items (1)
Low
SKILL.md:11SKILL.md:13SKILL.md:17SKILL.md:209SKILL.md:210SKILL.md:211
Hardcoded URLs to inference.sh Service
Six hardcoded URLs to inference.sh domain are present. These are legitimate URLs to the backend service required for video rendering functionality. Not malicious.
URLs point to inference.sh service homepage, image hosting, documentation, and GitHub raw content. All are legitimate service endpoints required for the skill to function.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: claude

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
High
SKILL.md:3SKILL.md:35
False Positive: Misidentified Cryptographic Pattern
Static scanner flagged 'weak cryptographic algorithm' at lines 3 and 35. Evaluation reveals these are false positives: line 3 is YAML frontmatter describing the skill, and line 35 is a markdown table header. No cryptographic algorithms exist in this file.
Line 3 contains YAML frontmatter with a description field, and line 35 is a markdown table separator. No cryptographic code is present in either location.
Medium
SKILL.md:7SKILL.md:17SKILL.md:19-30SKILL.md:72-80SKILL.md:84-92SKILL.md:96-104SKILL.md:108-117SKILL.md:121-129SKILL.md:186-190
False Positive: Misidentified Shell Execution Pattern
Static scanner flagged 'Ruby/shell backtick execution' at 32 locations. Evaluation reveals these are false positives - the scanner misidentified markdown code fences (```bash) and inline code markers as Ruby backtick execution. All flagged locations contain legitimate documentation examples showing belt CLI usage.
All flagged locations contain markdown code fences or inline code examples for the belt CLI tool. No Ruby backtick execution exists - the scanner pattern-matched markdown syntax incorrectly.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable