remotion-captions
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions.\n
- Ingestion points: SRT subtitle files are fetched and parsed in
import-srt-captions.md, and media files are processed intranscribe-captions.md.\n - Capability inventory: Instructions include running shell commands (
npx remotion) and writing files (writeFile).\n - Sanitization: No explicit validation or sanitization of the parsed text content is provided before it is used in the Remotion composition.\n- [EXTERNAL_DOWNLOADS]: The skill recommends downloading code from an external source.\n
- Evidence: Users are instructed to fetch the source for a
BasicCaptionscomponent fromhttps://www.remotion.dev/elements/captions/basic-captions.mdand copy it into their project.\n- [COMMAND_EXECUTION]: Provides instructions for running various CLI tools and scripts.\n - Evidence: Includes commands for adding packages via
npx,bunx,yarn, andpnpm, as well as a complete Node.js transcription script.
Audit Metadata