remotion-video-creation
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the fetching of data from external, potentially untrusted URLs to drive video composition properties and metadata.
- Ingestion points: Network operations in
rules/calculate-metadata.md,rules/compositions.md, andrules/lottie.mdingest data viafetch()from sources likeprops.dataUrlor external asset hosts. - Boundary markers: The instructions do not define boundary markers or instruct the agent to sanitize or ignore instructions embedded within the fetched data.
- Capability inventory: The skill uses network requests (
fetch), file metadata extraction (mediabunny), and rendering of dynamic React components. - Sanitization: Fetched JSON data is directly spread into component props or used for duration calculations without validation or filtering in the provided examples.
- [EXTERNAL_DOWNLOADS]: The skill contains references to external services for assets and documentation, such as
assets4.lottiefiles.comfor Lottie animations and officialremotion.devdocumentation links. - [COMMAND_EXECUTION]: The rule files include standard shell commands for project setup and package installation (e.g.,
npx remotion add) targeting framework-specific libraries like@remotion/three,@remotion/media, and@remotion/captions.
Audit Metadata