stitch-remotion

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [SAFE]: No malicious patterns, obfuscation, or security risks were identified. The skill follows standard practices for integrating Stitch and Remotion tools.
  • [EXTERNAL_DOWNLOADS]: The skill fetches screenshot assets from Stitch URLs and utilizes the Remotion skills library. These are well-known and trusted sources.
  • Evidence: screenshot.downloadUrl, htmlCode.downloadUrl from the Stitch API.
  • Evidence: Reference to github.com/remotion-dev/skills and remotion.dev for transitions and components.
  • [COMMAND_EXECUTION]: The skill instructs the agent to use standard package management and build tools for project setup and rendering.
  • Evidence: Use of npm create video@latest, npm install @remotion/transitions, and npx remotion render for building the video composition.
  • [PROMPT_INJECTION]: The skill processes user-provided screen data, such as titles and descriptions, to generate video overlays and narration scripts.
  • Ingestion points: [stitch_prefix]:get_screen provides titles and descriptions from the project.
  • Boundary markers: Not explicitly specified in the prompts.
  • Capability inventory: Shell access (Bash), file writing, and Node.js execution (npm/npx).
  • Sanitization: Not specified, but the processing is limited to generating UI text and scripts within the Remotion framework.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 04:14 AM
Security Audit — agent-trust-hub — stitch-remotion