remotion-beautiful-videos

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill workflow and internal scripts (beat-sync.ts, visual-audit.ts) execute shell commands such as cp, sed, ffmpeg, ffprobe, and od to manage project files and process media assets.\n- [REMOTE_CODE_EXECUTION]: Project initialization involves running npm install, which downloads and executes numerous dependencies from the npm registry.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites (scraped via bb-browser) to determine branding and content. Evidence chain: 1. Ingestion points: bb-browser open in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Shell execution (execSync) and package installation (npm install). 4. Sanitization: Absent.\n- [DYNAMIC_EXECUTION]: The agent dynamically generates React components and TypeScript logic based on user requirements and scraped branding data.\n- [EXTERNAL_DOWNLOADS]: The skill downloads assets (logos, music, videos) from arbitrary external URLs using tools like curl and yt-dlp.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 11:18 AM