B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Developer tools, Design & media
video-shotcraft
AI video skill for Claude Code & Codex — cinematic product videos with Remotion: 152 shot recipe cards, 209 motion previews, a production-ready template
Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
- Popularity score
- 46/100
- Rank
- #194 of 500
- GitHub stars
- 12.2k
What it does
video-shotcraft is an AI video production skill that generates cinematic product videos for Claude Code and Codex using Remotion. It includes 152 pre-built shot recipe cards, 209 motion previews, and a production-ready template to streamline video creation workflows.
Who it’s for
Product teams, marketers, and AI builders who need to generate professional demo or promotional videos programmatically. Best suited for organizations comfortable with code-first video generation and Remotion's React-based approach.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/Vincentwei1021/video-shotcraft (opens external site) for authoritative setup instructions. Likely involves cloning the repo, installing dependencies (npm install), and integrating the template with Claude Code or Codex, but exact steps require documentation review.
Risks
- Output data volume: Video rendering can consume significant storage and bandwidth; unclear if outputs are retained or transmitted externally.
- Supply chain dependency: Relies on Remotion library updates and third-party media assets; vulnerabilities in dependencies could affect all generated videos.
- Prompt injection potential: Recipe cards and motion parameters may be user-controllable; malicious input could alter video content or execution flow.
- No apparent credential isolation: Integration method unclear; verify that API keys or sensitive config are never embedded in video templates or logs.
- Transparency gap: Repository lacks security policy, audit trail, or disclosure process for vulnerabilities.
How to stay secure
Least-privilege permissions
- Restrict file access: Only grant the video skill permission to read input files and write to a single designated output folder. Block access to other company data, databases, or config files.
- Separate user accounts: Run video rendering on a dedicated user account with minimal permissions—never use admin or shared credentials.
- Limit API keys: If external services are used, create API keys specifically for this skill with the narrowest scope (read-only, time-limited, single project).
- Review template edits: Require approval before allowing anyone to modify recipe cards or motion settings; treat these like code changes.
Network isolation
- Outbound restrictions: Configure firewall rules so the skill can only reach approved Remotion servers and essential libraries—block unexpected external domains.
- No direct internet write access: Ensure generated videos cannot be automatically uploaded to cloud storage or external websites without explicit human approval.
- Air-gapped validation: Test video generation in an isolated environment before deploying to production systems.
- Dependency verification: Before updates, confirm that new Remotion library versions come from the official source and scan them for known vulnerabilities.
Monitoring
- Log all inputs and outputs: Record which recipe cards were used, who triggered rendering, and where files were stored—keep logs for at least 90 days.
- Storage quota alerts: Set up warnings if disk usage spikes unexpectedly; video files can grow large and signal abuse or misconfiguration.
- Audit parameter changes: Track any modifications to motion settings or templates; flag changes made outside normal business hours or by unexpected users.
- Monitor rendering failures: Unexpected crashes or errors may indicate a security issue; investigate before re-running the job.
Red flags to watch for
- Video file going missing: If output videos are stored but then disappear without explanation, suspect unauthorized deletion or external exfiltration.
- Unusual recipe card edits: Watch for changes to motion parameters that don't match your production needs or come from untrusted sources.
- Slow rendering or high CPU use: May indicate the skill is being exploited to mine cryptocurrency or run unintended code.
- External URL attempts: If logs show the video skill trying to contact unknown websites or IP addresses, isolate it immediately and investigate.
Alternatives
- Synthesia — AI video platform with avatar and voiceover generation; SaaS with stricter compliance controls.
- HeyGen — Generative video for marketing; cloud-hosted with enterprise SOC2 certifications.
- Runway ML — AI video editing and generation; supports custom models and local processing.
- Descript — Video-to-text and editing; focuses on narrative and voiceover workflows rather than cinematic templates.