Timeline Studio - Video Editing with AI
# Add to your Claude Code skills
git clone https://github.com/chatman-media/timeline-studioGuides for using ai agents skills like timeline-studio.
Last scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@babel/plugin-transform-modules-systemjs: @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@google-cloud/common: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@google-cloud/logging: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@google-cloud/opentelemetry-cloud-monitoring-exporter: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@google/gemini-cli-core: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/exporter-logs-otlp-grpc: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/exporter-logs-otlp-http: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/exporter-logs-otlp-proto: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/exporter-metrics-otlp-grpc: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/exporter-metrics-otlp-http: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/exporter-metrics-otlp-proto: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/exporter-prometheus: Prometheus exporter process crash via malformed HTTP request",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/exporter-trace-otlp-grpc: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/exporter-trace-otlp-http: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/exporter-trace-otlp-proto: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/otlp-exporter-base: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/otlp-grpc-exporter-base: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/otlp-transformer: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/sdk-node: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@storybook/addon-actions: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@storybook/addon-essentials: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@storybook/nextjs: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "basic-ftp: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "bn.js: bn.js affected by an infinite loop",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Large numeric range defeats documented `max` DoS protection",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "browserify-sign: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "create-ecdh: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "crypto-browserify: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "elliptic: Elliptic Uses a Cryptographic Primitive with a Risky Implementation",
"severity": "low"
},
{
"type": "npm-audit",
"message": "eventid: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "gaxios: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "google-gax: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "googleapis: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "googleapis-common: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "handlebars: Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "lodash-es: Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
"severity": "high"
},
{
"type": "npm-audit",
"message": "next: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "node-polyfill-webpack-plugin: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "protobufjs: Arbitrary code execution in protobufjs",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "retry-request: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ruv-swarm: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "teeny-request: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "undici: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
"severity": "high"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
}
],
"status": "FAILED",
"scannedAt": "2026-05-30T15:53:12.032Z",
"npmAuditRan": true,
"pipAuditRan": true
}No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
Italiano | Español | Français | Deutsch | Русский | 中文 | Português | 日本語 | 한국어 | Türkçe | ไทย | العربية | فارسی | हिन्दी
Timeline Studio is a next-generation professional video editor with AI integration that automates content creation for social media. Built on modern technologies (Tauri + Next.js), it combines the power of desktop applications with the convenience of web interfaces.
One upload → dozens of ready versions:
"Create a video about my trip to Asia for all social media" - and in minutes you have ready variants: dynamic shorts for TikTok, atmospheric vlog for YouTube, bright Stories for Instagram. AI selects the best moments, syncs with music and adapts for each platform.

Timeline Studio is built on modern modular architecture:
/src/features/ is self-containedcrates/* owns schema, render, media analysis, montage, publish and the timeline CLIpackages/core, packages/domains, packages/adapters, packages/uirender-job, bot-workflow, bot-worker and Rust timeline📚 Detailed Frontend Architecture → 📚 Detailed Backend Architecture → 📚 Plugin System → 🛠️ Technical Stack Details →
Timeline Studio features comprehensive AI integration with 100+ specialized tools:
📚 AI Chat Documentation → 🛠️ AI Tools Reference →
Timeline Studio uses a modular Rust + TypeScript workspace architecture. Desktop, CLI and bot/headless workflows share the same contracts where possible.
📚 External Headless Contracts - supported ProjectSchema, Rust timeline, render-job, bot-workflow, bot-worker and bot-cleanup entrypoints
🤖 Bot-First Production Contract - Telegram AI review state, restart, retry, cleanup and Rust publish boundary
🧪 Telegram AI Review Sandbox Smoke - mocked and real sandbox validation path
🧱 Package Boundaries - workspace ownership and import boundaries 🔁 Root Compatibility Shims - temporary root paths and migration criteria 🦀 Rust Backend Architecture - Rust/Tauri architecture and technology overview
src-tauri remains a desktop host/glue layer. External consumers should use the documented headless entrypoints instead of importing desktop internals.
🚀 Alpha version: 97.5% ready 🎯
✅ Completed: modular Rust workspace, TypeScript workspaces and bot-first/headless contract hardening 📋 Recently Completed:
core, domains, adapters, ui, apps/desktop and apps/cli# Clone and install
git clone https://github.com/chatman-media/timeline-studio.git
cd timeline-studio
bun install
# Run development mode
bun run tauri dev
# macOS
brew install ffmpeg
export ORT_DYLIB_PATH=/opt/homebrew/lib/libonnxruntime.dylib
# Windows - use setup script
./scripts/setup-rust-env-windows.ps1
# Linux
sudo ap