sketch-story-remotion
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard CLI commands for project lifecycle management.
- Evidence:
npm installis used for environment setup in the project directory. - Evidence:
npx tscis used for static analysis and type checking of the generated React code. - Evidence:
npx remotionis used for rendering still previews and the final video output. - [EXTERNAL_DOWNLOADS]: The skill involves standard downloads from official registries and well-known technology services.
- Evidence: Fetches official packages from the NPM registry as defined in the provided
package.json. - Evidence: Triggers the download of the Chrome Headless Shell binary, which is a standard component of the Remotion/Puppeteer rendering stack.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface typical of data-transformation tools.
- Ingestion points: Reads user-supplied markdown scripts from a local vault folder to derive scene content.
- Boundary markers: The skill instructions focus on structural parsing (beat checklists), which limits the impact of embedded instructions, though no explicit sanitization is performed.
- Capability inventory: Capabilities are scoped to local file system operations (project creation) and standard development CLI tools.
- Sanitization: Input content is processed as text for narration and scene composition without specific executable sanitization.
Audit Metadata