remotion-to-hyperframes
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to run various shell commands and local scripts including 'scripts/lint_source.py', 'scripts/render_diff.sh', 'scripts/frame_strip.sh', and the test orchestrator './assets/test-corpus/run.sh'.\n- [DYNAMIC_EXECUTION]: The workflow relies on dynamic execution by invoking Python and Bash scripts as well as Node.js CLI tools ('npx remotion', 'npx hyperframes') to perform its tasks at runtime.\n- [INDIRECT_PROMPT_INJECTION]: The skill operates on third-party source code in the 'remotion-src' directory. Because it triggers rendering processes that execute JavaScript code, a maliciously crafted source project could lead to unauthorized code execution.\n
- Ingestion points: User-provided Remotion source files within 'remotion-src'.\n
- Boundary markers: Includes a 'lint_source.py' script intended to identify and block problematic React patterns before they are processed.\n
- Capability inventory: Ability to execute shell scripts, read/write files, and invoke various development tools.\n
- Sanitization: Employs pre-execution linting to filter out unsupported or unsafe code constructs.\n- [EXTERNAL_DOWNLOADS]: The use of 'npx' within the instructions implies the download and potential execution of Node.js packages from the public npm registry.
Audit Metadata