remotion-video

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The prompt includes a "companion check" that explicitly instructs the agent to run local shell commands (ls ...) and propose installing packages—actions that access the local filesystem and perform installs unrelated to Remotion's stated video-authoring purpose, so this is a hidden/deceptive instruction outside the skill's scope.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's documentation and required patterns explicitly show fetching and using external public URLs (e.g., references/project-structure.md's useAsyncData with fetch('https://api.example.com/stats'), references/rendering-guide.md prefetch('https://example.com/...') and external serveUrl examples), so untrusted third‑party content would be ingested and can directly influence rendering/input props and agent behavior.