remotion-multimedia

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external media files (audio and video) which constitutes an indirect prompt injection attack surface. Malicious instructions embedded in media metadata could potentially influence the agent's behavior during processing.
  • Ingestion points: The skill utilizes UrlSource, FilePathSource, and BlobSource in get-audio-duration.md, get-video-dimensions.md, and get-video-duration.md to ingest data from remote URLs, local file systems, and user-provided blobs.
  • Boundary markers: There are no explicit boundary markers or instructions to ignore embedded content within the provided code snippets.
  • Capability inventory: The skill is designed to extract media metadata, specifically duration and display dimensions, using methods like input.computeDuration() and input.getPrimaryVideoTrack().
  • Sanitization: The instructions do not include steps for sanitizing or validating the contents of the media files before processing.
  • [EXTERNAL_DOWNLOADS]: The skill references an external resource at https://mediabunny.dev/llms.txt to provide a compact overview of library capabilities. This reference to the official documentation is documented neutrally as a standard informational source.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 04:45 PM