stitch-remotion
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to download screenshot assets via
curland usesnpm/npxfor project initialization and video rendering. - [EXTERNAL_DOWNLOADS]: Fetches and installs the Remotion video framework and transition packages from the official npm registry.
- [DYNAMIC_EXECUTION]: Programmatically generates React (TSX) source files for video compositions and slides, which are then compiled and rendered into MP4 files using the Remotion CLI.
- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect injection by processing screen titles and descriptions retrieved from the external Stitch API.
- Ingestion points: Screen metadata stored in
screens.json(retrieved viastitch-mcp). - Boundary markers: None identified for the interpolated text content.
- Capability inventory: Includes file system access (
Write), network operations (curl), and shell command execution (npm,npx). - Sanitization: Relies on standard React/TSX escaping mechanisms when rendering strings in the generated components.
Audit Metadata