remotion-captions
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Tool and Package Installation: The skill instructs the user to install official packages from the Remotion ecosystem and downloads necessary binaries for transcription.
- Evidence: Installation of
@remotion/captionsand@remotion/install-whisper-cppusing standard package managers. - Evidence: Use of
installWhisperCppanddownloadWhisperModelfunctions to fetch transcription tools and models. - Dynamic Execution of Local Binaries: The transcription process involves installing a specific version of
whisper.cppand executing it locally. - Evidence:
installWhisperCpp({ version: '1.5.5' })followed by thetranscribefunction call intranscribe-captions.md. - Command Line Interaction: The instructions provide commands for various package managers to set up the environment.
- Evidence:
npx,bunx,yarn, andpnpm execcommands inimport-srt-captions.mdanddisplay-captions.md. - Indirect Prompt Injection Surface: The skill is designed to ingest and process external content such as
.srtfiles and audio recordings. - Ingestion points: The skill fetches
.srtfiles from local or remote sources inimport-srt-captions.mdand reads audio files for transcription intranscribe-captions.md. - Boundary markers: The skill does not explicitly define delimiters for the ingested data within the provided logic.
- Capability inventory: The skill has the capability to write files to the disk (
fs.writeFileSync) and execute the transcription binary. - Sanitization: Processing relies on the
parseSrtutility and the transcription library's internal handling of input data.
Audit Metadata