remotion-video-toolkit

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent on using several CLI commands for project initialization, package management, and rendering, primarily through npx remotion and specific subcommands like remotion render and remotion still (found in SKILL.md, rules/rendering.md, and several other rule files).
  • [EXTERNAL_DOWNLOADS]: Instructions throughout the toolkit involve fetching remote assets and data. Examples include retrieving Lottie animation files from lottiefiles.com in rules/lottie.md, accessing video assets from remotion.media in rules/videos.md, and downloading dynamic configuration via fetch in rules/calculate-metadata.md and rules/import-srt-captions.md.
  • [DYNAMIC_EXECUTION]: The skill describes core Remotion workflows that involve bundling React code at runtime using @remotion/bundler and executing it within a headless browser context to generate video frames, as detailed in the Node.js API and Express server patterns in rules/rendering.md.
  • [INDIRECT_PROMPT_INJECTION]:
    • Ingestion points: Untrusted data enters the skill's execution context through props.dataUrl in rules/calculate-metadata.md, remote .srt subtitle files in rules/import-srt-captions.md, and input props provided via CLI or HTTP requests in rules/rendering.md.
    • Boundary markers: The provided code examples do not demonstrate the use of delimiters or specific instructions to the agent to ignore potentially malicious embedded content within the ingested data.
    • Capability inventory: The skill possesses capabilities to perform network operations (fetch), write rendered media files to the local file system, and execute shell commands via the Remotion CLI.
    • Sanitization: The instructional examples for parsing data (JSON/SRT) do not include explicit sanitization or strict schema validation steps before the data is used to drive the video rendering process.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 06:17 AM