Headless video rendering with Remotion v5 on any Linux server — no Mac or GUI needed. Templates for chat demos, promos, and more. Uses Chrome Headless Shell...
Security Analysis
high confidenceThe skill's files, instructions, and requested tools are consistent with a headless Remotion renderer; it performs expected package installs and scaffolding and does not request unrelated credentials or exotic installs.
Name/description (headless Remotion rendering) align with what the skill requires and does: node/npm, creating a Remotion project, installing Remotion via npm, and installing OS browser dependencies for Chrome headless. Nothing in the manifest asks for unrelated capabilities or secrets.
SKILL.md instructs running the supplied setup.sh and create.sh and then using npx remotion render — all actions are within the stated goal. The scripts create local project files and call apt-get/npm; they do not attempt to read arbitrary host files, exfiltrate data, or contact non-standard network endpoints beyond normal package registries.
No platform install spec (instruction-only), but the included scripts run 'npm install' and 'npx' which fetch packages from the npm registry and run apt-get for system libs. This is expected for scaffolding/renderer setup but carries normal supply-chain risk inherent to npm/apt installs; no downloads from personal servers or obscure URLs are present.
The skill requests no environment variables or credentials. The only system interactions are package installs and checks for sudo and node version, which are proportional to headless rendering setup.
The skill is user-invocable, not always-enabled, and does not modify other skills or global configs. It creates local project directories only and does not persist background services or attempt to enable itself globally.
Guidance
This skill appears to do what it says: it scaffolds Remotion projects and installs OS/browser dependencies so Chrome Headless can render. Before running: (1) Review scripts (already provided) and run them in a controlled host or container if you are cautious. (2) Note that 'npm install' and 'npx' will fetch and execute code from the npm registry — review package.json / installed packages if you need to limit supply-chain risk. (3) setup.sh uses apt-get and sudo — ensure you trust the machine and that required packages are acceptable. (4) Small issues: the 24.04 branch contains an odd package name (libasound2t64) which may be a typo and could cause install failure on that OS. If you plan to run on production machines, consider running the setup inside an isolated container or VM and audit installed npm dependencies.
Latest Release
v1.2.1
Fix display name (remove Clawdbot prefix)
More by @mvanhorn
Published by @mvanhorn on ClawHub
