remotion-promo-video-factory
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell scripts (
scripts/capture-frames.shandscripts/verify-build.sh) to perform video rendering and build validation. These scripts executenpx remotion still,npx tsc, andnpm run build. While these are standard operations for a video-as-code workflow, they involve executing shell commands within the project environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local project context to drive video generation, which creates a potential surface for indirect injection.
- Ingestion points:
SKILL.mdStep 1 (README, docs, landing page, and UI/CLI/API examples). - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: File system access and shell command execution via the provided scripts (
npx remotion,npm run). - Sanitization: No explicit sanitization or validation of the ingested text is performed before it is used to define narrative and scene structure.
Audit Metadata