remotion-captions
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and installs official Remotion framework packages, such as
@remotion/captionsand@remotion/install-whisper-cpp, using thenpx remotion addcommand. - [EXTERNAL_DOWNLOADS]: Automatically downloads the Whisper.cpp binary (version 1.5.5) and pre-trained models (e.g., 'medium.en') through library functions provided in the
transcribe-captions.mdfile. - [COMMAND_EXECUTION]: Executes shell commands via
npxto manage project dependencies and provides code for local filesystem operations usingfs.writeFileSyncto save generated JSON captions. - [COMMAND_EXECUTION]: Includes references to media processing via
ffmpegusingchild_process.execSyncfor audio-to-wav conversion during the transcription workflow. - [PROMPT_INJECTION]: Implements an ingestion surface for untrusted data by providing code to fetch and parse external
.srtfiles and remote URLs. - Ingestion points:
fetch()calls inimport-srt-captions.mdanddisplay-captions.md. - Boundary markers: Absent.
- Capability inventory: Filesystem writes (
fs.writeFileSync) and binary execution (installWhisperCpp) across the skill scripts. - Sanitization: Content is processed through the
parseSrtandJSON.parsefunctions before rendering.
Audit Metadata