remotion
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches screenshots and HTML metadata from Google's Stitch platform using download URLs retrieved from the project API.
- [EXTERNAL_DOWNLOADS]: Downloads and installs official Remotion packages and agent skills from the npm registry and the remotion-dev GitHub organization.
- [COMMAND_EXECUTION]: Executes shell commands via Bash for project initialization (npm create), dependency management (npm install), and video rendering (npx remotion render).
- [PROMPT_INJECTION]: Identifies an indirect prompt injection surface where the agent is instructed to parse HTML content from external Stitch projects to generate timed text overlays. \n
- Ingestion points: htmlCode.downloadUrl referenced in SKILL.md \n
- Boundary markers: None provided for external content interpolation \n
- Capability inventory: Write (file generation) and Bash (execution) as defined in SKILL.md \n
- Sanitization: No specific sanitization or validation steps are defined for the retrieved HTML content.
Audit Metadata