remotion-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill performs project upgrades using commands such as
npx remotion upgradeandnpx skills update. These operations are essential for modifying package manifests and lockfiles as requested by the user. - External Content Retrieval: The instructions direct the agent to fetch versioning information and compatibility guidelines from
remotion.devandgithub.com. Using official documentation ensures that the upgrade process follows the maintainers' latest recommendations. - Automated Update Patterns: The skill uses the
--yesflag with theskills updatecommand, which allows the agent to update related skills without individual confirmation prompts. This is a common pattern in automation scripts intended for streamlined workflows. - Indirect Prompt Injection Surface: The skill ingests data from external web pages (release notes and compatibility docs) to determine target versions. While this is a common attack surface, the risk is mitigated by the use of official, well-known project repositories and documentation sites.
Audit Metadata