remotion-video-toolkit

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructions define several ingestion points for untrusted data.\n
  • Ingestion points: The calculateMetadata function (in rules/calculate-metadata.md) fetches data from a user-supplied props.dataUrl. The parseSrt logic (in rules/import-srt-captions.md) fetches subtitle files from remote URLs. The Lottie component (in rules/lottie.md) fetches animation data from external URLs. Most significantly, the Express server pattern (in rules/rendering.md) accepts arbitrary props via a POST request to /render.\n
  • Boundary markers: No explicit boundary markers or "ignore instructions" directives are included in the prompt templates.\n
  • Capability inventory: The skill leverages @remotion/renderer which executes code in a headless browser environment to render videos. It also performs network operations via the fetch API and file operations through staticFile.\n
  • Sanitization: The provided examples do not include sanitization or validation logic for the fetched data or input props before they are used in the rendering process.\n- [EXTERNAL_DOWNLOADS]: The skill references several external resources and instructs the agent to install various @remotion/* packages.\n
  • Evidence: Instructions in rules/tailwind.md suggest fetching documentation from https://www.remotion.dev/docs/tailwind. Code examples in rules/lottie.md fetch assets from https://assets4.lottiefiles.com. These are well-known services for the respective technologies.\n
  • Packages: The skill relies on numerous Node.js packages including @remotion/media, @remotion/captions, and mediabunny.\n- [COMMAND_EXECUTION]: The skill provides numerous CLI commands for project management and rendering.\n
  • Evidence: npx create-video@latest, npx remotion render, npx remotion add @remotion/media, etc. These are standard developer tools for the Remotion ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 04:43 AM