remotion
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a documentation guide for Remotion, a programmatic video framework for React. All mentioned tools, such as
npx remotionandnpx create-video, and packages like@remotion/mediaand@remotion/renderer, are standard and official components of the Remotion ecosystem. - [SAFE]: The instructions include a specific security warning advising users to never commit API keys for external services (e.g., ElevenLabs or Whisper) to source control, which aligns with industry best practices for credential management.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a potential data ingestion surface through the use of
calculateMetadatato fetch external data. - Ingestion points:
calculateMetadatafunction (SKILL.md) which fetches data before rendering. - Boundary markers: None mentioned, as the data is used for rendering parameters.
- Capability inventory: The skill is scoped to rendering React components to video frames; it does not instruct the agent to execute shell commands or interpolate untrusted strings into system prompts.
- Sanitization: Not specified, as the context is programmatic video generation rather than natural language processing of untrusted input.
Audit Metadata