remotion
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents APIs for ingesting untrusted data into the video rendering pipeline. 1. Ingestion points: reference.md documents getInputProps() for reading CLI arguments and provides a calculateMetadata example fetching from /api/data. 2. Boundary markers: No delimiters or ignore-instructions warnings are present in the examples. 3. Capability inventory: The skill documents the @remotion/renderer API in reference.md, which includes file-writing capabilities (e.g., outputLocation). 4. Sanitization: No sanitization or escaping of the external content is shown in the provided code snippets.
- [COMMAND_EXECUTION]: The skill includes instructions to run a development command, npm run studio, within the project directory. This is a standard operation for previewing Remotion compositions.
Audit Metadata