video-edit
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the official Remotion TikTok template from github.com/remotion-dev/template-tiktok and installs its dependencies via npm. These actions target a well-known organization and are necessary for the skill's functionality. It also suggests adding remotion-dev/skills using the npx skills tool.
- [COMMAND_EXECUTION]: Extensive use of ffmpeg and ffprobe for media analysis and processing, alongside node for logic execution and subtitle generation. The commands are standard for automated video production workflows.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted transcript data derived from user video takes. 1. Ingestion points: Reads transcript words from public JSON files and video metadata from ffprobe output. 2. Boundary markers: None explicitly used during JSON data manipulation. 3. Capability inventory: Uses Bash to execute ffmpeg, node, and remotion render commands across scripts. 4. Sanitization: Transcript text is interpolated into React components and .srt files without specific sanitization against prompt injection, though the impact is limited to visual captions.
Audit Metadata