remotion

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as a documentation guide for Remotion, a programmatic video framework for React. All mentioned tools, such as npx remotion and npx create-video, and packages like @remotion/media and @remotion/renderer, are standard and official components of the Remotion ecosystem.
  • [SAFE]: The instructions include a specific security warning advising users to never commit API keys for external services (e.g., ElevenLabs or Whisper) to source control, which aligns with industry best practices for credential management.
  • [INDIRECT_PROMPT_INJECTION]: The skill identifies a potential data ingestion surface through the use of calculateMetadata to fetch external data.
  • Ingestion points: calculateMetadata function (SKILL.md) which fetches data before rendering.
  • Boundary markers: None mentioned, as the data is used for rendering parameters.
  • Capability inventory: The skill is scoped to rendering React components to video frames; it does not instruct the agent to execute shell commands or interpolate untrusted strings into system prompts.
  • Sanitization: Not specified, as the context is programmatic video generation rather than natural language processing of untrusted input.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 06:52 PM