digitalsamba/claude-code-video-toolkit

Review signals: 206 known vulnerability.

OSV reports a known vulnerability in this dependency version. 15 distinct locations. 195 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• uv sync creates the Python environment from the lockfile: Real input produced the expected result: Resolved 121 packages

  Source: `uv sync` creates `.venv/` and installs everything from the lockfile in seconds.

  Input: uv sync in the toolkit checkout

  Expected: dependencies resolved from the lockfile

  Command: <guest-path> sync

  Observed: Resolved 121 packages in 4ms Checked 39 packages in 27ms

• Quick start render needs no API keys and outputs an MP4 immediately: Remotion render requires a headless Chrome; Remotion auto-downloads one on first render (about 220MB in node_modules/.remotion), which the task forbids, and no shared CDP endpoint is configured in this guest. The hello-world render was run once before this was noticed; the downloaded browser was removed and the render was not replayed.

  Source: > No API keys needed — outputs an MP4 immediately.

  Observed: Remotion render requires a headless Chrome; Remotion auto-downloads one on first render (about 220MB in node_modules/.remotion), which the task forbids, and no shared CDP endpoint is configured in this guest. The hello-world render was run once before this was noticed; the downloaded browser was removed and the render was not replayed.

Examples

• Pre-render QC of a project runs without changing it and reports PASS: command completed successfully

  Source: tools/qc.py module docstring (Usage: uv run tools/qc.py --project projects/my-video)

  Input: --project examples/hello-world

  Expected: QC report ending in PASS with 0 errors and 0 warnings

  Command: <guest-path> run tools/qc.py --project examples/hello-world

  Observed: QC — <guest-path> (sprint-review-v1) assets checked: 0 | scenes timed: 0 | pacing measured: 0 | loudness measured: 0 PASS: 0 error(s), 0 warning(s)

• Quick start: render hello-world to an MP4 with no API keys: Not replayed: npm install and the Remotion render succeed in this guest, but the render auto-downloads a headless Chrome (forbidden) and no shared CDP endpoint is configured. The earlier render output was removed; it was produced with that downloaded browser and is not trusted as evidence.

  Source: README.md Quick Start: cd examples/hello-world && npm install && npm run render

  Expected: documented command completes successfully

  Observed: Not replayed: npm install and the Remotion render succeed in this guest, but the render auto-downloads a headless Chrome (forbidden) and no shared CDP endpoint is configured. The earlier render output was removed; it was produced with that downloaded browser and is not trusted as evidence.

Local or hosted: both

Render examples/hello-world to an MP4 with `npm run render` (README Quick Start), plus a read-only pre-render QC of the same project with tools/qc.py.

cd <guest-path> && ls -la && cat README.md | head -200 && python3 --version && id -u && cat /etc/os-release | head -3
cd <guest-path> && sed -n 200,400p README.md; cat .python-version; grep -n requires-python pyproject.toml; ls examples/hello-world; cat examples/hello-world/package.json 2>/dev/null; node --version; npm --version; which uv ffmpeg
cd <guest-path> && git --version; git init -q && git remote add origin https://github.com/digitalsamba/claude-code-video-toolkit && git fetch --depth 1 origin da3f474c1230d161be1384ef97aec27f73b11636 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; git status --short | head
cd /tmp && (curl -fsSL https://deb.nodesource.com/setup_20.x -o /tmp/ns.sh && sudo -n bash /tmp/ns.sh >/tmp/ns.log 2>&1 && sudo -n apt-get install -y nodejs >>/tmp/ns.log 2>&1); echo rc=$?; tail -3 /tmp/ns.log; node --version; npm --version
cd <guest-path> && curl -LsSf https://astral.sh/uv/install.sh | sh 2>&1 | tail -2; export PATH=$HOME/.local/bin:$PATH; uv --version && uv sync 2>&1 | tail -5; echo rc=$?
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm install 2>&1 | tail -5; echo rc=$?
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && ls out 2>/dev/null; timeout 900 npm run render 2>&1 | tail -25; echo rc=${PIPESTATUS[0]}; ls -la out 2>/dev/null
cd <guest-path> && ls -la node_modules/.remotion 2>/dev/null; find / -iname "chrome-headless-shell*" -maxdepth 6 2>/dev/null | head; ls ~/.cache 2>/dev/null; ffprobe -v error -show_entries format=duration -of csv=p=0 out/video.mp4 2>/dev/null || echo "no ffprobe"; file out/video.mp4
cd <guest-path> && du -sh node_modules/.remotion && rm -rf node_modules/.remotion && echo removed; cd <guest-path> && ls tools tests scripts | head -80; grep -rn "mcp" --include=*.json -l . 2>/dev/null | grep -v node_modules | head; grep -n "def main\|add_parser\|--json" tools/voiceover.py | head -5
cd <guest-path> && grep -n "pacing\|captions.py\|qc.py\|sync_timing\|verify_setup\|config.py" README.md docs/*.md | head -30; sed -n 1,40p tools/pacing.py
cd <guest-path> && env | grep -i "cdp\|chrome\|browser\|proxy" | sed 's/=.*/=<set>/' ; find tests -type f | head -20; ls /inputs 2>/dev/null; ls <guest-path> 2>/dev/null
cd <guest-path> && ls /inputs/ 2>&1; which chromium chromium-browser google-chrome 2>&1 | head -2; sed -n 1,30p tools/qc.py; sed -n 1,25p tools/captions.py | head -30; sed -n 1,20p tools/sync_timing.py
cd <guest-path> && export PATH=$HOME/.local/bin:$PATH && which ffmpeg; uv run tools/qc.py --project examples/hello-world 2>&1 | tail -30; echo rc=${PIPESTATUS[0]}
cd <guest-path> && export PATH=$HOME/.local/bin:$PATH && sudo -n apt-get install -y ffmpeg >/tmp/ff.log 2>&1 || (sudo -n apt-get update >/dev/null 2>&1 && sudo -n apt-get install -y ffmpeg >/tmp/ff.log 2>&1); echo apt=$?; ffmpeg -version | head -1; uv run tools/qc.py --project examples/hello-world 2>&1 | tail -30; echo rc=${PIPESTATUS[0]}
cd <guest-path> && echo $HOME; export PATH=$HOME/.local/bin:$PATH; uv sync 2>&1; echo rc=$?; grep -rniE "cron|schedule|webhook|--once|--now|while True|loop" tools/*.py scripts/*.py lib --include=*.py --include=*.ts -l 2>/dev/null | head; grep -n "da3f\|^\(\S\)" /dev/null; grep -c "Python dependencies are managed with \[uv\]" README.md; grep -n "No API keys needed" README.md
cd <guest-path> && rm -rf examples/hello-world/out && mkdir -p .coldpass && U=<guest-path> && python3 - <<'EOF'
import json
ws="<guest-path>"
U="<guest-path>"
qc_argv=[U,"run","tools/qc.py","--project","examples/hello-world"]
probe={"kind":"cli","argv":qc_argv,"cwd":ws,"expected_text":"PASS: 0 error(s), 0 warning(s)"}
claims=[
 {"kind":"claim","claim":"uv sync creates the Python environment from the lockfile",
  "source":"`uv sync` creates `.venv/` and installs everything from the lockfile in seconds.",
  "input":"uv sync in the toolkit checkout","expected":"dependencies resolved from the lockfile",
  "probe_kind":"cli","argv":[U,"sync"],"cwd":ws,"expected_text":"Resolved 121 packages"},
 {"kind":"claim","claim":"Quick start render needs no API keys and outputs an MP4 immediately",
  "source":"> No API keys needed — outputs an MP4 immediately.",
  "testable":False,"reason":"Remotion render requires a headless Chrome; Remotion auto-downloads one on first render (about 220MB in node_modules/.remotion), which the task forbids, and no shared CDP endpoint is configured in this guest. The hello-world render was run once before this was noticed; the downloaded browser was removed and the render was not replayed."}
]
json.dump(claims,open(ws+"/.coldpass/claims.json","w"),indent=2,ensure_ascii=False)
json.dump(probe,open(ws+"/.coldpass/probe.json","w"),indent=2)
cycles={"detected":False,"reason":"Entry points inspected (README, tools/*.py, scripts/*.py, lib/): the toolkit is run on demand from Claude Code slash commands or uv run tools/<tool>.py. No cron, scheduler, webhook, --once/--now or polling loop was found; grep hits (sync_timing, file_transfer, modal_setup, notebooklm_brand, sixtydb_tts, youtube_upload) are not product cycles.","checks":[]}
json.dump(cycles,open(ws+"/.coldpass/cycles.json","w"),indent=2)
examples=[
 {"kind":"example","claim":"Pre-render QC of a project runs without changing it and reports PASS",
  "source":"tools/qc.py module docstring (Usage: uv run tools/qc.py --project projects/my-video)",
  "input":"--project examples/hello-world","expected":"QC report ending in PASS with 0 errors and 0 warnings",
  "argv":qc_argv,"cwd":ws,"env":{},"expected_text":"PASS: 0 error(s), 0 warning(s)"},
 {"kind":"example","claim":"Quick start: render hello-world to an MP4 with no API keys",
  "source":"README.md Quick Start: cd examples/hello-world && npm install && npm run render",
  "reason":"Not replayed: npm install and the Remotion render succeed in this guest, but the render auto-downloads a headless Chrome (forbidden) and no shared CDP endpoint is configured. The earlier render output was removed; it was produced with that downloaded browser and is not trusted as evidence."}
]
json.dump(examples,open(ws+"/.coldpass/examples.json","w"),indent=2,ensure_ascii=False)
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40; echo rc=$?
cd <guest-path> && python3 - <<'EOF'
import json
r={
 "outcome":"needs_browser",
 "fault_owner":"prerequisite",
 "operation":"Render examples/hello-world to an MP4 with `npm run render` (README Quick Start), plus a read-only pre-render QC of the same project with tools/qc.py.",
 "operation_scope":"Local guest, Ubuntu 24.04, Python 3.12.3, Node 20.20.2 (installed from NodeSource), uv 0.13.5, ffmpeg 6.1.1. No API keys, no cloud GPU. The render needs a headless Chrome; no shared CDP endpoint is configured in this guest and downloading a browser is not permitted.",
 "steps":[
  "git init; git remote add origin https://github.com/digitalsamba/claude-code-video-toolkit; git fetch --depth 1 origin da3f474c1230d161be1384ef97aec27f73b11636; git reset --mixed FETCH_HEAD",
  "sudo apt-get install nodejs (NodeSource setup_20.x) -- Node was missing; README requires Node 18+",
  "curl -LsSf https://astral.sh/uv/install.sh | sh -- README uv install line",
  "uv sync (README Quick Start)",
  "cd examples/hello-world && NODE_USE_ENV_PROXY=1 npm install (README quick start)",
  "cd examples/hello-world && npm run render (README quick start) -- succeeded, but Remotion auto-downloaded chrome-headless-shell (~220MB) into node_modules/.remotion; that download was not permitted and the directory was deleted afterwards",
  "sudo apt-get install ffmpeg (needed by tools/qc.py)",
  "uv run tools/qc.py --project examples/hello-world -- PASS: 0 error(s), 0 warning(s)"
 ],
 "deviations":[
  "Node/npm were absent; installed Node 20 via NodeSource and apt (setup, not a product failure).",
  "npm run render auto-downloaded a headless Chrome into examples/hello-world/node_modules/.remotion. This violates the no-browser-download rule. I removed that directory. The out/video.mp4 it produced was also removed, so it is not evidence and the render was not replayed.",
  "Probe is tools/qc.py (documented in its own docstring, not the README). It is read-only and passes, but the hello-world project has no assets, audio or scenes, so it checked 0 items. It exercises the QC path, not a meaningful media check.",
  "ffmpeg was not present and was installed via apt to satisfy qc.py.",
  "No cycle/scheduler found; cycles.json has detected=false."
 ],
 "stuck_step":"npm run render (README Quick Start): Remotion needs a headless Chrome and this guest has none, no CDP endpoint, and browser downloads are prohibited.",
 "main_blocker":"Required headless browser for Remotion rendering is not available in this guest.",
 "plain_failure":"The toolkit's main video render cannot be run here. Setup works (Node, uv, npm packages, ffmpeg) and a quality check runs, but turning a project into a video needs a browser that this test machine is not allowed to download and that no shared browser endpoint provides.",
 "suggested_fix":"Provide a shared CDP/Chrome endpoint or a preinstalled Chrome for Remotion (e.g. via REMOTION_BROWSER_EXECUTABLE or --browser-executable) in the test guest. Separately, the README could say that the first `npm run render` downloads a ~220MB headless Chrome, so users know it is not offline."
}
json.dump(r,open(".coldpass/report.json","w"),indent=2,ensure_ascii=False)
EOF
ls examples/hello-world; ls .coldpass; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay >/tmp/final.json 2>&1; python3 -c "import json;d=json.load(open('/tmp/final.json'));print(d.get('valid'),d.get('problems'),d['replay']['status'])" 2>/dev/null || tail -c 400 /tmp/final.json