remotion
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements patterns for fetching dynamic metadata and content from external URLs or identifiers provided via component properties. This creates an ingestion surface for untrusted data.
- Ingestion points:
rules/calculate-metadata.md(fetches fromprops.dataUrl),rules/compositions.md(fetches from an external API usingprops.videoId), andrules/voiceover.md(processes external TTS API responses). - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded prompts in the fetched content.
- Capability inventory: The skill has the capability to perform network requests (
fetch), write to the local file system (fs.writeFileSync), and execute shell commands (npx remotion ffmpeg). - Sanitization: No explicit sanitization or validation of the external content is performed before it is used to influence the composition's logic or metadata.
- [EXTERNAL_DOWNLOADS]: The skill contains instructions for downloading external assets and installing media processing tools.
rules/transcribe-captions.md: Orchestrates the download and local installation of thewhisper.cppbinary and associated models.rules/sfx.md: Fetches audio files fromremotion.mediaand references a third-party GitHub repository (kapishdima/soundcn) for sound effects.- Multiple files: Provide instructions for installing various packages from the npm registry to enable specific features (e.g.,
@remotion/three,mapbox-gl,zod). - [REMOTE_CODE_EXECUTION]: The skill automates the installation of binary executables for media transcription.
rules/transcribe-captions.md: Uses the@remotion/install-whisper-cpputility to download, compile, and install thewhisper.cpptool directly into the project workspace.- [COMMAND_EXECUTION]: The skill uses command-line interfaces for project setup and media processing.
SKILL.md: Usesnpx create-videofor scaffolding new projects.rules/ffmpeg.mdandrules/silence-detection.md: Usenpx remotion ffmpegandnpx remotion ffprobeto execute complex media manipulation tasks.
Audit Metadata