stitch-remotion
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or security risks were identified. The skill follows standard practices for integrating Stitch and Remotion tools.
- [EXTERNAL_DOWNLOADS]: The skill fetches screenshot assets from Stitch URLs and utilizes the Remotion skills library. These are well-known and trusted sources.
- Evidence:
screenshot.downloadUrl,htmlCode.downloadUrlfrom the Stitch API. - Evidence: Reference to
github.com/remotion-dev/skillsandremotion.devfor transitions and components. - [COMMAND_EXECUTION]: The skill instructs the agent to use standard package management and build tools for project setup and rendering.
- Evidence: Use of
npm create video@latest,npm install @remotion/transitions, andnpx remotion renderfor building the video composition. - [PROMPT_INJECTION]: The skill processes user-provided screen data, such as titles and descriptions, to generate video overlays and narration scripts.
- Ingestion points:
[stitch_prefix]:get_screenprovides titles and descriptions from the project. - Boundary markers: Not explicitly specified in the prompts.
- Capability inventory: Shell access (Bash), file writing, and Node.js execution (npm/npx).
- Sanitization: Not specified, but the processing is limited to generating UI text and scripts within the Remotion framework.
Audit Metadata