remotion-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as
npx remotion upgradeandnpx skills updateto maintain the project. These operations are restricted to the primary purpose of the skill and utilize established CLI tools within the Remotion and AI agent ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data by reading project manifests (
package.json) and lockfiles. While this presents an attack surface where malicious instructions could be embedded in package metadata, the risk is minimal as the agent uses this data specifically for version alignment and dependency management. - Ingestion points: Project manifests (
package.json) and lockfiles. - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: Execution of
npm view,npx remotion, andnpx skillscommands. - Sanitization: Relies on the standard output and validation of the underlying package managers.
Audit Metadata