video-content

Warn

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill implements a dynamic code generation workflow. In Phase 4 of the video assembly, it scaffolds a Remotion project and generates slide components by reading from marketing/handoffs/{name}-handoff.yaml. This YAML file contains an extracted_jsx field that stores raw HTML/CSS/JSX snippets. These snippets are incorporated into the project's source files and subsequently executed during the rendering process using bunx remotion render. This creates a pathway for data-driven code execution.
  • [EXTERNAL_DOWNLOADS]: The workflow performs automated package installation using bun add. It downloads several Node.js packages from the Remotion ecosystem, such as @remotion/cli, @remotion/transitions, @remotion/google-fonts, and @remotion/layout-utils. While these are well-known development tools, they are installed and executed at runtime without version pinning.
  • [COMMAND_EXECUTION]: The skill relies heavily on shell commands for media processing. It uses ffmpeg for image slicing and video encoding, and bun for project management. Many of these commands are constructed using variables derived from external configuration files (e.g., IMAGE_HEIGHT, SLIDE_COUNT, SLIDE_HEIGHT), which can be a surface for command injection if the input data is not properly validated.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 14, 2026, 02:06 PM
Security Audit — agent-trust-hub — video-content