remotion-render
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses well-known and official packages from the Remotion ecosystem, including @remotion/bundler and @remotion/renderer, and executes the remotion tool via npx.
- [COMMAND_EXECUTION]: Shell commands are used to invoke npx remotion for rendering video files and still frames from React components.
- [DATA_EXFILTRATION]: Rendered video and image files are written to the /data/output/ directory, which is appropriate for the skill's stated purpose of media generation.
- [PROMPT_INJECTION]: The skill implements a pattern for passing dynamic data into video compositions via --props and inputProps. This constitutes an indirect prompt injection surface if untrusted data is supplied to the agent.
- Ingestion points: CLI --props and API inputProps parameters in SKILL.md.
- Boundary markers: None; the provided examples do not use delimiters for the external data.
- Capability inventory: File system write access and execution of the Remotion CLI.
- Sanitization: No explicit sanitization or validation of input properties is shown in the provided code snippets.
Audit Metadata