remotion-video

Pass

Audited by Gen Agent Trust Hub on Apr 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a directory listing command (ls) on several local paths (e.g., ~/.claude/skills/) to check for the presence of recommended companion skills. This is a discovery step to assist the user with project setup.\n- [PROMPT_INJECTION]: Documentation includes implementation patterns for fetching dynamic data via fetch() to drive video content, which introduces an indirect prompt injection surface. Malicious content from an external API could influence agent behavior if the ingested data is processed without sanitization.\n
  • Ingestion points: useAsyncData hook in references/project-structure.md.\n
  • Boundary markers: None identified in the provided implementation examples.\n
  • Capability inventory: Subprocess execution via npx remotion and file system writes during media rendering.\n
  • Sanitization: No validation or escaping logic is demonstrated in the provided code snippets.\n- [DATA_EXFILTRATION]: The skill references network operations for asset prefetching and dynamic data loading. These examples utilize placeholder domains and represent standard functionality for data-driven video generation.\n- [EXTERNAL_DOWNLOADS]: The documentation references standard ecosystem tools such as npx create-video, npx remotion, and npm for project scaffolding, rendering, and dependency management. It also mentions the author's own skill installation registry.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 4, 2026, 05:22 AM
Security Audit — agent-trust-hub — remotion-video