remotion

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing official Remotion plugin packages (e.g., @remotion/three, @remotion/media, @remotion/google-fonts, @remotion/lottie) from standard package registries. It also demonstrates how to fetch external assets such as video clips, images, and Lottie JSON files from remote URLs (e.g., remotion.media, lottiefiles.com).
  • [COMMAND_EXECUTION]: The documentation includes standard shell commands for managing project dependencies using npx, yarn, pnpm, or bun. These commands are used to add official framework extensions.
  • [INDIRECT_PROMPT_INJECTION]: The skill contains patterns for fetching dynamic data (JSON, SRT captions, Lottie assets) from external APIs and files during the video rendering process. While this creates an ingestion point for untrusted data, the code examples use this data strictly for rendering properties (such as duration, dimensions, and text display) without passing it to high-risk sinks like shell commands or dynamic code evaluators.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 01:47 PM
Security Audit — agent-trust-hub — remotion