remotion-video-toolkit
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill provides standard development patterns for the Remotion framework.
- [PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection as it ingests untrusted data via
inputPropsto generate video content. This is a characteristic of media generation tools. - Ingestion points: Data enters via the
inputPropsparameter in rendering functions and through thecalculateMetadatahook (rules/calculate-metadata.md). - Boundary markers: Absent. The skill does not instruct on the use of delimiters for user-provided strings used in compositions.
- Capability inventory: The skill demonstrates fetching remote data (rules/calculate-metadata.md, rules/lottie.md) and writing files to the local system during rendering.
- Sanitization: Absent. Input data is directly interpolated into React components for rendering visuals.
- [COMMAND_EXECUTION]: The toolkit describes the use of standard
npx remotionCLI commands for rendering videos and deploying serverless functions. These patterns are consistent with the official Remotion documentation and intended use cases. - [EXTERNAL_DOWNLOADS]: The skill correctly references official Remotion packages and reputable services for assets, such as Google Fonts and LottieFiles. All external references are appropriate for the toolkit's purpose.
Audit Metadata