cmo-remotion
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses various shell commands through tools like
npm,npx,node, andffmpegto handle project scaffolding, dependency management, and the final rendering of MP4 video files. - [EXTERNAL_DOWNLOADS]: During the project setup phase, the skill fetches external code by running
npx create-video@latestandnpm install, which download packages directly from the npm registry. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes brand-specific files (e.g., voice-profile, positioning) and user-supplied briefs to generate scripts and video compositions.
Audit Metadata