remotion

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs running installer commands that fetch and install the remotion Claude-skill from the remote repository https://github.com/remotion-dev/skills (via "npx add-skill remotion-dev/skills" / "/plugin marketplace add remotion-dev/skills"), which will download and install remote code at runtime that the skill workflow relies on, so this external URL is a runtime dependency that can execute remote code.