video-composer
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using
subprocess.runinscripts/render_video.pyto runnpm installandnpx remotionfor video rendering. This is standard behavior for a project that relies on a rendering engine. - [EXTERNAL_DOWNLOADS]: The orchestration scripts trigger package downloads from the official npm registry (e.g.,
remotion,react) during rendering. The skill also provides commands to install sibling media generation skills from the author's official repository on GitHub. - [DYNAMIC_EXECUTION]: The
scripts/scaffold.pyscript creates a new project directory populated with TypeScript and React templates. These files are then dynamically loaded and executed by the Remotion CLI during the video creation process. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes user requirements and inspects generated images. This risk is managed through a structured workflow that includes a mandatory approval step by the user before proceeding to generation and rendering.
Audit Metadata