video-composer

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands using subprocess.run in scripts/render_video.py to run npm install and npx remotion for video rendering. This is standard behavior for a project that relies on a rendering engine.
  • [EXTERNAL_DOWNLOADS]: The orchestration scripts trigger package downloads from the official npm registry (e.g., remotion, react) during rendering. The skill also provides commands to install sibling media generation skills from the author's official repository on GitHub.
  • [DYNAMIC_EXECUTION]: The scripts/scaffold.py script creates a new project directory populated with TypeScript and React templates. These files are then dynamically loaded and executed by the Remotion CLI during the video creation process.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes user requirements and inspects generated images. This risk is managed through a structured workflow that includes a mandatory approval step by the user before proceeding to generation and rendering.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 04:22 AM