remotion-video

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: Python scripts use subprocess.run to call ffprobe and ffmpeg for media file analysis and conversion. These operations are performed on files generated by the scripts themselves using hardcoded identifiers, preventing command injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill references reputable sources for dependencies, including the Remotion ecosystem on NPM and the vLLM-Omni repository by the thudm research group. It also utilizes standard utilities for downloading necessary AI models like Whisper.\n- [CREDENTIALS_UNSAFE]: API keys and identifiers are handled through environment variables, which is the recommended secure practice for managing sensitive configuration in development environments.\n- [DATA_EXFILTRATION]: Network requests are strictly limited to the intended functionality of the skill, specifically communicating with legitimate TTS API endpoints or local model servers. No patterns of data harvesting or unauthorized exfiltration were identified.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 02:29 PM
Security Audit — agent-trust-hub — remotion-video