remotion
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains directives to "Ignore Claude-specific mode-switch instructions" and enforces a "Strict execution contract." These instructions are intended to stabilize the agent's behavior during complex video orchestration tasks.
- [COMMAND_EXECUTION]: Shell commands are used for project lifecycle management, including initialization via
npx create-video, dependency installation withnpm install, and starting the local development server withnpm run studio. - [REMOTE_CODE_EXECUTION]: The skill utilizes
npxto execute tools likecreate-videoandremotionCLI directly, which involves running remote code from the official Remotion registry. - [EXTERNAL_DOWNLOADS]: Integrations with well-known services such as ElevenLabs for text-to-speech, Mapbox for map rendering, and Google Fonts for typography are documented. These interactions are standard for the skill's purpose.
- [CREDENTIALS_SAFE]: The skill identifies the need for API keys for external services but appropriately advises users to manage these secrets through
.envfiles, avoiding hardcoded credentials in the codebase. - [INDIRECT_PROMPT_INJECTION]: As the skill processes user-defined video descriptions to generate code, it possesses an ingestion surface for external data. However, the capabilities are scoped to project-specific files and standard development tools.
Audit Metadata