generate-video

Pass

Audited by Gen Agent Trust Hub on Apr 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/render-video.js executes the Remotion CLI to render video files. The implementation uses the spawn method with shell: false to prevent command injection and includes explicit validation logic to ensure that resolved asset paths remain within the project scope, protecting against directory traversal.
  • [EXTERNAL_DOWNLOADS]: The skill makes authorized API requests to Google's generative language services (Gemini) for image asset creation. This is a documented core feature and uses official, well-known endpoints for its operations.
  • [SAFE]: A detailed audit of the code and instructions revealed no evidence of prompt injection, credential exfiltration, or malicious obfuscation. The skill follows best practices for secret management by utilizing environment variables for API keys and includes an extensive suite of automated tests to verify the integrity of the generation pipeline.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 15, 2026, 09:18 PM