elevenlabs-remotion
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The generate.js script utilizes the child_process.execSync module to execute ffmpeg and ffprobe commands. These are used for necessary tasks like calculating audio duration, detecting silence, and embedding thumbnails into video files. The script uses double-quotes around file path variables to prevent simple shell injection.
- [SAFE]: Network activity is restricted to the ElevenLabs API (api.elevenlabs.io), which is the intended service for the skill's primary function. No unauthorized or suspicious network connections were detected.
- [SAFE]: The skill follows secure practices for credential management by instructing users to store their ElevenLabs API key in a .env.local file instead of hardcoding it.
- [SAFE]: The skill includes an indirect prompt injection surface through its design system extraction logic (reading project files and fetching remote URLs for branding), but this is handled within the scope of providing project-specific context and does not exhibit malicious intent.
Audit Metadata