remotion-video-creation
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install official Remotion packages (e.g., @remotion/three, @remotion/media) from the project's official ecosystem using standard package managers.
- [COMMAND_EXECUTION]: The documentation includes code snippets for the remotion add command to facilitate the installation of necessary framework extensions.
- [DATA_EXFILTRATION]: Code examples utilize the fetch() API to retrieve remote assets such as JSON metadata and Lottie animations, which is a standard requirement for dynamic video generation.
- [PROMPT_INJECTION]: The skill provides patterns for ingesting external data (JSON, subtitles, media), which constitutes an indirect prompt injection surface.
- Ingestion points: The calculateMetadata function and Lottie component fetch data from remote URLs, while parseSrt processes external subtitle files.
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are included in the code templates.
- Capability inventory: The skill utilizes fetch for network requests and DOM APIs for rendering external content.
- Sanitization: Data sanitization logic is not explicitly detailed in the provided architectural examples.
Audit Metadata