remotion-create
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use
npx create-video@latest, which fetches the project scaffolding utility from the official npm registry. - [COMMAND_EXECUTION]: The skill provides instructions for standard development workflows, including package installation (
npm i), starting a preview server (npx remotion studio), and rendering video files (npx remotion render). - [INDIRECT_PROMPT_INJECTION]: The skill generates React markup based on user prompts, which creates a potential surface for indirect injection if malicious content is provided by the user to be included in the video composition.
- Ingestion points: User descriptions of video content and product promos defined in
SKILL.md. - Boundary markers: None explicitly defined for the generated React components.
- Capability inventory: Local shell execution for project scaffolding, dependency management, and video rendering.
- Sanitization: Not specified for user-provided text or data interpolated into the video layout.
Audit Metadata