remotion-upgrade

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • Command Execution: The skill performs project upgrades using commands such as npx remotion upgrade and npx skills update. These operations are essential for modifying package manifests and lockfiles as requested by the user.
  • External Content Retrieval: The instructions direct the agent to fetch versioning information and compatibility guidelines from remotion.dev and github.com. Using official documentation ensures that the upgrade process follows the maintainers' latest recommendations.
  • Automated Update Patterns: The skill uses the --yes flag with the skills update command, which allows the agent to update related skills without individual confirmation prompts. This is a common pattern in automation scripts intended for streamlined workflows.
  • Indirect Prompt Injection Surface: The skill ingests data from external web pages (release notes and compatibility docs) to determine target versions. While this is a common attack surface, the risk is mitigated by the use of official, well-known project repositories and documentation sites.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 11:18 AM
Security Audit — agent-trust-hub — remotion-upgrade