skills/guyronnen/openmontage/remotion/Gen Agent Trust Hub

remotion

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill suggests running npm run studio within the showcase directory to preview transition effects. This is a standard development command used to launch the Remotion Studio environment.
  • [INDIRECT_PROMPT_INJECTION]: The calculateMetadata API documented in reference.md allows video compositions to fetch and process data from external endpoints at runtime.
  • Ingestion points: Data enters the composition through the fetch call within calculateMetadata located in reference.md.
  • Boundary markers: The documentation does not specify boundary markers or instructions to ignore embedded prompts within the fetched data.
  • Capability inventory: The skill documents extensive capabilities including cloud deployment via @remotion/lambda, file rendering via @remotion/renderer, and local file access through staticFile.
  • Sanitization: The provided code examples do not include explicit sanitization or validation logic for the external data being fetched.
  • [DYNAMIC_EXECUTION]: The documentation includes references to @remotion/bundler and @remotion/renderer for programmatically bundling and rendering video projects. These tools perform dynamic code compilation and execution as part of the framework's standard operation.
  • [EXTERNAL_DOWNLOADS]: The skill references the official Remotion repository and a toolkit repository on GitHub. These references are used to point to source code and documentation for the framework and its extensions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 12:09 AM
Security Audit — agent-trust-hub — remotion