remotion
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use standard shell commands for project initialization and video rendering. Evidence includes usage of
npx create-video@latest,npm i, andnpx remotion(subcommands: studio, render, still, lambda). - [EXTERNAL_DOWNLOADS]: The documentation references multiple official packages from the
@remotionecosystem for extended functionality. Referenced packages includeremotion,@remotion/transitions,@remotion/google-fonts,@remotion/three,@remotion/gif,@remotion/lottie,@remotion/media-utils,@remotion/captions,@remotion/zod-types, and@remotion/media. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates an API pattern (
calculateMetadata) that fetches external JSON data to determine video properties like duration. Ingestion points:SKILL.md(in thecalculateMetadataasync function example). Boundary markers: Absent in the documentation example. Capability inventory: The skill allows network fetching (fetch) and subsequent video frame generation. Sanitization: The provided example does not include data validation or sanitization of the external JSON payload before usage.
Audit Metadata