skills/espennilsen/pi/remotion/Gen Agent Trust Hub

remotion

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements patterns for fetching dynamic metadata and content from external URLs or identifiers provided via component properties. This creates an ingestion surface for untrusted data.
  • Ingestion points: rules/calculate-metadata.md (fetches from props.dataUrl), rules/compositions.md (fetches from an external API using props.videoId), and rules/voiceover.md (processes external TTS API responses).
  • Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded prompts in the fetched content.
  • Capability inventory: The skill has the capability to perform network requests (fetch), write to the local file system (fs.writeFileSync), and execute shell commands (npx remotion ffmpeg).
  • Sanitization: No explicit sanitization or validation of the external content is performed before it is used to influence the composition's logic or metadata.
  • [EXTERNAL_DOWNLOADS]: The skill contains instructions for downloading external assets and installing media processing tools.
  • rules/transcribe-captions.md: Orchestrates the download and local installation of the whisper.cpp binary and associated models.
  • rules/sfx.md: Fetches audio files from remotion.media and references a third-party GitHub repository (kapishdima/soundcn) for sound effects.
  • Multiple files: Provide instructions for installing various packages from the npm registry to enable specific features (e.g., @remotion/three, mapbox-gl, zod).
  • [REMOTE_CODE_EXECUTION]: The skill automates the installation of binary executables for media transcription.
  • rules/transcribe-captions.md: Uses the @remotion/install-whisper-cpp utility to download, compile, and install the whisper.cpp tool directly into the project workspace.
  • [COMMAND_EXECUTION]: The skill uses command-line interfaces for project setup and media processing.
  • SKILL.md: Uses npx create-video for scaffolding new projects.
  • rules/ffmpeg.md and rules/silence-detection.md: Use npx remotion ffmpeg and npx remotion ffprobe to execute complex media manipulation tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 11:41 AM