remotion-to-hyperframes
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow involves executing several shell-based tools including
npm,npx,ffmpeg, andffprobe. These are used for dependency management, video rendering, and metadata extraction during the translation validation process. - [DYNAMIC_EXECUTION]: Internal helper scripts (
render_diff.sh,frame_strip.sh,run.sh) utilize Python heredocs to perform data processing tasks such as parsing SSIM logs and calculating distribution statistics. This execution is limited to local, static code blocks within the skill's own scripts. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Remotion source code provided by the user. It mitigates potential injection risks through the mandatory use of
scripts/lint_source.py, which identifies and blocks incompatible or dangerous React constructs before the agent begins the translation process. - Ingestion points: Remotion source files (.ts, .tsx) read by the agent and the linting script.
- Boundary markers: The
lint_source.pyutility acts as a primary safety boundary, refusing to proceed if blockers are detected. - Capability inventory: File reading, shell command execution for video rendering and testing, and Python execution for log analysis.
- Sanitization: Source code is validated against a list of 'blocker' rules that prevent the processing of non-deterministic or side-effect-heavy code.
Audit Metadata