remotion
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill suggests running
npm run studiowithin the showcase directory to preview transition effects. This is a standard development command used to launch the Remotion Studio environment. - [INDIRECT_PROMPT_INJECTION]: The
calculateMetadataAPI documented inreference.mdallows video compositions to fetch and process data from external endpoints at runtime. - Ingestion points: Data enters the composition through the
fetchcall withincalculateMetadatalocated inreference.md. - Boundary markers: The documentation does not specify boundary markers or instructions to ignore embedded prompts within the fetched data.
- Capability inventory: The skill documents extensive capabilities including cloud deployment via
@remotion/lambda, file rendering via@remotion/renderer, and local file access throughstaticFile. - Sanitization: The provided code examples do not include explicit sanitization or validation logic for the external data being fetched.
- [DYNAMIC_EXECUTION]: The documentation includes references to
@remotion/bundlerand@remotion/rendererfor programmatically bundling and rendering video projects. These tools perform dynamic code compilation and execution as part of the framework's standard operation. - [EXTERNAL_DOWNLOADS]: The skill references the official Remotion repository and a toolkit repository on GitHub. These references are used to point to source code and documentation for the framework and its extensions.
Audit Metadata