cmo-remotion

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's workflow and README explicitly instruct running npx to fetch-and-run remote npm packages (e.g., "npx create-video@latest --yes --blank --no-tailwind " and several "npx remotion ..." commands), which will download and execute remote code at runtime.