video-composer

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands via subprocess.run in scripts/render_video.py to perform npm install and npx remotion render. This is the intended behavior for rendering videos with the Remotion framework.
  • [REMOTE_CODE_EXECUTION]: The scripts/scaffold.py script generates a Remotion project (TypeScript files), which is then built and executed by the agent using standard Node.js tools. The code is generated from static templates provided in the skill.
  • [EXTERNAL_DOWNLOADS]: The skill references and provides commands to install sibling skills from the vendor's repository (github.com/danishi/claude-code-config). These downloads are part of the setup for its orchestration functionality.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it accepts user input to generate composition plans and prompts for sibling media skills. The workflow mitigates this by requiring explicit user approval before asset generation and including a self-review step.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 09:52 AM
Security Audit — agent-trust-hub — video-composer