remotion-create
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Dependency Management: The skill uses standard package management tools like
npxandnpmto scaffold projects and install dependencies (e.g.,npx create-video@latest). These are routine operations for setting up development environments and utilize established package registries. - Local Service Execution: The skill provides instructions to run a local development and preview server using
npx remotion studio. This allows the agent to host a local preview of the video project, which is a standard feature of the Remotion framework. - Indirect Prompt Injection Surface: The skill processes user-supplied prompts to generate React-based video markup. This creates a surface for processing untrusted data within the intended scope of video creation.
- Ingestion points: User input provided via the primary interaction prompt defined in
agents/openai.yaml. - Boundary markers: None explicitly defined within the instruction files.
- Capability inventory: The skill utilizes shell command execution for project setup (
npx,npm) and local server hosting (remotion studio). - Sanitization: Not explicitly defined in the skill markdown; the skill relies on the agent's internal logic for safe code generation.
Audit Metadata