cmo-remotion

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses various shell commands through tools like npm, npx, node, and ffmpeg to handle project scaffolding, dependency management, and the final rendering of MP4 video files.
  • [EXTERNAL_DOWNLOADS]: During the project setup phase, the skill fetches external code by running npx create-video@latest and npm install, which download packages directly from the npm registry.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes brand-specific files (e.g., voice-profile, positioning) and user-supplied briefs to generate scripts and video compositions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 02:06 PM
Security Audit — agent-trust-hub — cmo-remotion