skills/openai/plugins/remotion-create/Gen Agent Trust Hub

remotion-create

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • External Dependency Management: The skill uses standard package management tools like npx and npm to scaffold projects and install dependencies (e.g., npx create-video@latest). These are routine operations for setting up development environments and utilize established package registries.
  • Local Service Execution: The skill provides instructions to run a local development and preview server using npx remotion studio. This allows the agent to host a local preview of the video project, which is a standard feature of the Remotion framework.
  • Indirect Prompt Injection Surface: The skill processes user-supplied prompts to generate React-based video markup. This creates a surface for processing untrusted data within the intended scope of video creation.
  • Ingestion points: User input provided via the primary interaction prompt defined in agents/openai.yaml.
  • Boundary markers: None explicitly defined within the instruction files.
  • Capability inventory: The skill utilizes shell command execution for project setup (npx, npm) and local server hosting (remotion studio).
  • Sanitization: Not explicitly defined in the skill markdown; the skill relies on the agent's internal logic for safe code generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 11:18 AM
Security Audit — agent-trust-hub — remotion-create