create-motion-graphics-remotion
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill initializes a local project environment by downloading official libraries from the npm registry, including
remotion,react, andtypescript. These are standard dependencies for the skill's stated purpose of programmatic video rendering. - [COMMAND_EXECUTION]: The skill utilizes shell scripts (
scripts/init-remotion-project.shandscripts/render-composition.sh) to automate the initialization of the React project and the rendering of video files. These scripts execute commands such asnpm installandnpx remotion renderto perform their tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted data to determine the content of the rendered video.
- Ingestion points: The skill reads scene definitions, text copy, and animation parameters from an external
manifest.jsonandstoryboard.htmlfile. - Boundary markers: The instructions do not specify the use of clear delimiters or instructions to ignore embedded commands within the storyboard data.
- Capability inventory: The skill has the capability to write files to the local disk and execute shell commands to render the video, providing a path for generated code to be executed.
- Sanitization: There is no explicit requirement for the agent to sanitize or escape the content of the storyboard manifest before it is interpolated into the generated React components (
Scene{NN}.tsx). - [DYNAMIC_EXECUTION]: The skill dynamically generates React source code based on provided templates (
references/scene-template.tsx) and manifest data. This generated code is then bundled and executed by the Remotion engine to produce video output. While this is the intended functionality, it represents a dynamic execution pattern.
Audit Metadata