remotion-captions

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • External Tool and Package Installation: The skill instructs the user to install official packages from the Remotion ecosystem and downloads necessary binaries for transcription.
  • Evidence: Installation of @remotion/captions and @remotion/install-whisper-cpp using standard package managers.
  • Evidence: Use of installWhisperCpp and downloadWhisperModel functions to fetch transcription tools and models.
  • Dynamic Execution of Local Binaries: The transcription process involves installing a specific version of whisper.cpp and executing it locally.
  • Evidence: installWhisperCpp({ version: '1.5.5' }) followed by the transcribe function call in transcribe-captions.md.
  • Command Line Interaction: The instructions provide commands for various package managers to set up the environment.
  • Evidence: npx, bunx, yarn, and pnpm exec commands in import-srt-captions.md and display-captions.md.
  • Indirect Prompt Injection Surface: The skill is designed to ingest and process external content such as .srt files and audio recordings.
  • Ingestion points: The skill fetches .srt files from local or remote sources in import-srt-captions.md and reads audio files for transcription in transcribe-captions.md.
  • Boundary markers: The skill does not explicitly define delimiters for the ingested data within the provided logic.
  • Capability inventory: The skill has the capability to write files to the disk (fs.writeFileSync) and execute the transcription binary.
  • Sanitization: Processing relies on the parseSrt utility and the transcription library's internal handling of input data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 11:18 AM
Security Audit — agent-trust-hub — remotion-captions