video-composer
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands via
subprocess.runinscripts/render_video.pyto performnpm installandnpx remotion render. This is the intended behavior for rendering videos with the Remotion framework. - [REMOTE_CODE_EXECUTION]: The
scripts/scaffold.pyscript generates a Remotion project (TypeScript files), which is then built and executed by the agent using standard Node.js tools. The code is generated from static templates provided in the skill. - [EXTERNAL_DOWNLOADS]: The skill references and provides commands to install sibling skills from the vendor's repository (
github.com/danishi/claude-code-config). These downloads are part of the setup for its orchestration functionality. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it accepts user input to generate composition plans and prompts for sibling media skills. The workflow mitigates this by requiring explicit user approval before asset generation and including a self-review step.
Audit Metadata