remotion-beautiful-videos
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow and internal scripts (
beat-sync.ts,visual-audit.ts) execute shell commands such ascp,sed,ffmpeg,ffprobe, andodto manage project files and process media assets.\n- [REMOTE_CODE_EXECUTION]: Project initialization involves runningnpm install, which downloads and executes numerous dependencies from the npm registry.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites (scraped viabb-browser) to determine branding and content. Evidence chain: 1. Ingestion points:bb-browser openinSKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Shell execution (execSync) and package installation (npm install). 4. Sanitization: Absent.\n- [DYNAMIC_EXECUTION]: The agent dynamically generates React components and TypeScript logic based on user requirements and scraped branding data.\n- [EXTERNAL_DOWNLOADS]: The skill downloads assets (logos, music, videos) from arbitrary external URLs using tools likecurlandyt-dlp.
Audit Metadata