remotion
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
web_fetchandcurlvia a bash script (scripts/download-stitch-asset.sh) to download screenshots and HTML assets from Stitch project URLs. These assets are typically hosted on well-known Google Cloud Storage domains (storage.googleapis.com). - [COMMAND_EXECUTION]: The instructions direct the agent to use
npmfor project initialization (npm create video@latest) and dependency management (npm install @remotion/transitions). It also utilizesnpx remotion renderto execute the video rendering process locally. - [DATA_INGESTION]: The skill ingests external content from Stitch projects, such as screen titles, descriptions, and HTML code, to automatically generate text overlays and callouts in the video. This is a core feature of the skill's intended functionality.
- [DYNAMIC_CODE_GENERATION]: To create the videos, the agent generates TypeScript and React components (
WalkthroughComposition.tsx,ScreenSlide.tsx) based on templates and project metadata. This script generation is standard for the Remotion framework and occurs within the local project environment.
Audit Metadata