remotion-graphics
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation notes that the first render operation triggers the download of a headless Chromium browser (~150–300 MB) via the Remotion framework. It also uses
npm installto fetch project dependencies. - [COMMAND_EXECUTION]: The skill provides templates for executing shell commands, specifically
npm install,npx remotion render, andffmpegto generate motion graphics and composite them onto video footage. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external transcript data to sync animations with speech.
- Ingestion points: Extracts word-level timestamps and text from a transcript file (referenced via
--words) to populate cues and kinetic captions. - Boundary markers: None explicitly defined in the instructions, though the skill utilizes structured
inputPropsJSON for component parameters. - Capability inventory: Includes the ability to install packages, render graphics via a headless browser, and perform video encoding/compositing with
ffmpeg. - Sanitization: The instructions favor passing data via JSON props rather than hard-coding, which provides some structure, but no explicit sanitization or validation of the transcript content is performed before processing.
Audit Metadata