remotion-video-creation

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the fetching of data from external, potentially untrusted URLs to drive video composition properties and metadata.
  • Ingestion points: Network operations in rules/calculate-metadata.md, rules/compositions.md, and rules/lottie.md ingest data via fetch() from sources like props.dataUrl or external asset hosts.
  • Boundary markers: The instructions do not define boundary markers or instruct the agent to sanitize or ignore instructions embedded within the fetched data.
  • Capability inventory: The skill uses network requests (fetch), file metadata extraction (mediabunny), and rendering of dynamic React components.
  • Sanitization: Fetched JSON data is directly spread into component props or used for duration calculations without validation or filtering in the provided examples.
  • [EXTERNAL_DOWNLOADS]: The skill contains references to external services for assets and documentation, such as assets4.lottiefiles.com for Lottie animations and official remotion.dev documentation links.
  • [COMMAND_EXECUTION]: The rule files include standard shell commands for project setup and package installation (e.g., npx remotion add) targeting framework-specific libraries like @remotion/three, @remotion/media, and @remotion/captions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 06:04 AM