stitch-remotion

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to download screenshot assets via curl and uses npm/npx for project initialization and video rendering.
  • [EXTERNAL_DOWNLOADS]: Fetches and installs the Remotion video framework and transition packages from the official npm registry.
  • [DYNAMIC_EXECUTION]: Programmatically generates React (TSX) source files for video compositions and slides, which are then compiled and rendered into MP4 files using the Remotion CLI.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect injection by processing screen titles and descriptions retrieved from the external Stitch API.
  • Ingestion points: Screen metadata stored in screens.json (retrieved via stitch-mcp).
  • Boundary markers: None identified for the interpolated text content.
  • Capability inventory: Includes file system access (Write), network operations (curl), and shell command execution (npm, npx).
  • Sanitization: Relies on standard React/TSX escaping mechanisms when rendering strings in the generated components.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 09:01 PM