remotion-multimedia
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external media files (audio and video) which constitutes an indirect prompt injection attack surface. Malicious instructions embedded in media metadata could potentially influence the agent's behavior during processing.
- Ingestion points: The skill utilizes
UrlSource,FilePathSource, andBlobSourceinget-audio-duration.md,get-video-dimensions.md, andget-video-duration.mdto ingest data from remote URLs, local file systems, and user-provided blobs. - Boundary markers: There are no explicit boundary markers or instructions to ignore embedded content within the provided code snippets.
- Capability inventory: The skill is designed to extract media metadata, specifically duration and display dimensions, using methods like
input.computeDuration()andinput.getPrimaryVideoTrack(). - Sanitization: The instructions do not include steps for sanitizing or validating the contents of the media files before processing.
- [EXTERNAL_DOWNLOADS]: The skill references an external resource at
https://mediabunny.dev/llms.txtto provide a compact overview of library capabilities. This reference to the official documentation is documented neutrally as a standard informational source.
Audit Metadata