video-content
Warn
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill implements a dynamic code generation workflow. In Phase 4 of the video assembly, it scaffolds a Remotion project and generates slide components by reading from
marketing/handoffs/{name}-handoff.yaml. This YAML file contains anextracted_jsxfield that stores raw HTML/CSS/JSX snippets. These snippets are incorporated into the project's source files and subsequently executed during the rendering process usingbunx remotion render. This creates a pathway for data-driven code execution. - [EXTERNAL_DOWNLOADS]: The workflow performs automated package installation using
bun add. It downloads several Node.js packages from the Remotion ecosystem, such as@remotion/cli,@remotion/transitions,@remotion/google-fonts, and@remotion/layout-utils. While these are well-known development tools, they are installed and executed at runtime without version pinning. - [COMMAND_EXECUTION]: The skill relies heavily on shell commands for media processing. It uses
ffmpegfor image slicing and video encoding, andbunfor project management. Many of these commands are constructed using variables derived from external configuration files (e.g.,IMAGE_HEIGHT,SLIDE_COUNT,SLIDE_HEIGHT), which can be a surface for command injection if the input data is not properly validated.
Audit Metadata