remotion-graphics

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation notes that the first render operation triggers the download of a headless Chromium browser (~150–300 MB) via the Remotion framework. It also uses npm install to fetch project dependencies.
  • [COMMAND_EXECUTION]: The skill provides templates for executing shell commands, specifically npm install, npx remotion render, and ffmpeg to generate motion graphics and composite them onto video footage.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external transcript data to sync animations with speech.
  • Ingestion points: Extracts word-level timestamps and text from a transcript file (referenced via --words) to populate cues and kinetic captions.
  • Boundary markers: None explicitly defined in the instructions, though the skill utilizes structured inputProps JSON for component parameters.
  • Capability inventory: Includes the ability to install packages, render graphics via a headless browser, and perform video encoding/compositing with ffmpeg.
  • Sanitization: The instructions favor passing data via JSON props rather than hard-coding, which provides some structure, but no explicit sanitization or validation of the transcript content is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 03:34 PM