frame-and-explain
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous instructions for executing shell commands to manage a Remotion project.
- Examples include scaffolding new projects with
npx create-video, adding official plugins vianpx remotion add, and rendering videos usingnpx remotion render. - It also includes instructions for running custom Node.js scripts (e.g.,
generate-voiceover.ts) and invoking FFmpeg for video processing. - [EXTERNAL_DOWNLOADS]: The skill references several external resources for assets and configuration.
- Fetches sound effects, videos, and documentation from
remotion.mediaandremotion.dev. - Downloads Lottie animation files from
assets4.lottiefiles.comand MapLibre styles fromdemotiles.maplibre.org. - Downloads the Whisper.cpp binary and models via the
@remotion/install-whisper-cpppackage for audio transcription. - [DATA_EXFILTRATION]: To support AI-generated voiceovers, the skill provides patterns for sending text data to
api.elevenlabs.io. - This process requires the use of an
ELEVENLABS_API_KEY, which the skill correctly instructs to be handled via environment variables rather than being hardcoded. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests untrusted data that influences the generation of video content.
- Ingestion points:
calculateMetadatafetches JSON data from external URLs;defaultPropsinCompositionobjects; and external SRT/JSON caption files. - Boundary markers: None explicitly defined in the provided code snippets.
- Capability inventory: The skill can write files to the local file system (
fs.writeFileSync), perform network requests (fetch), and execute shell commands (ffmpeg). - Sanitization: No specific sanitization or validation of the fetched content is demonstrated in the examples.
Audit Metadata