remotion-captions

Pass

Audited by Gen Agent Trust Hub on Jul 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches and installs official Remotion framework packages, such as @remotion/captions and @remotion/install-whisper-cpp, using the npx remotion add command.
  • [EXTERNAL_DOWNLOADS]: Automatically downloads the Whisper.cpp binary (version 1.5.5) and pre-trained models (e.g., 'medium.en') through library functions provided in the transcribe-captions.md file.
  • [COMMAND_EXECUTION]: Executes shell commands via npx to manage project dependencies and provides code for local filesystem operations using fs.writeFileSync to save generated JSON captions.
  • [COMMAND_EXECUTION]: Includes references to media processing via ffmpeg using child_process.execSync for audio-to-wav conversion during the transcription workflow.
  • [PROMPT_INJECTION]: Implements an ingestion surface for untrusted data by providing code to fetch and parse external .srt files and remote URLs.
  • Ingestion points: fetch() calls in import-srt-captions.md and display-captions.md.
  • Boundary markers: Absent.
  • Capability inventory: Filesystem writes (fs.writeFileSync) and binary execution (installWhisperCpp) across the skill scripts.
  • Sanitization: Content is processed through the parseSrt and JSON.parse functions before rendering.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 17, 2026, 09:49 PM
Security Audit — agent-trust-hub — remotion-captions