sketch-story-remotion

Pass

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses standard CLI commands for project lifecycle management.
  • Evidence: npm install is used for environment setup in the project directory.
  • Evidence: npx tsc is used for static analysis and type checking of the generated React code.
  • Evidence: npx remotion is used for rendering still previews and the final video output.
  • [EXTERNAL_DOWNLOADS]: The skill involves standard downloads from official registries and well-known technology services.
  • Evidence: Fetches official packages from the NPM registry as defined in the provided package.json.
  • Evidence: Triggers the download of the Chrome Headless Shell binary, which is a standard component of the Remotion/Puppeteer rendering stack.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface typical of data-transformation tools.
  • Ingestion points: Reads user-supplied markdown scripts from a local vault folder to derive scene content.
  • Boundary markers: The skill instructions focus on structural parsing (beat checklists), which limits the impact of embedded instructions, though no explicit sanitization is performed.
  • Capability inventory: Capabilities are scoped to local file system operations (project creation) and standard development CLI tools.
  • Sanitization: Input content is processed as text for narration and scene composition without specific executable sanitization.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 8, 2026, 05:53 PM
Security Audit — agent-trust-hub — sketch-story-remotion