remotion-media
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill facilitates the ingestion of external data sources, including API responses and subtitle files, into the agent's working context. This processing of untrusted data represents an indirect prompt injection surface where instructions hidden within the content could influence the agent's behavior during the composition review or generation process.
- Ingestion points: External API data fetched via
fetch('/api/data')(SKILL.md) and word-timed subtitle JSON arrays (references/captions.md). - Boundary markers: The skill does not define specific delimiters or instructions to treat these external inputs as strictly data rather than commands.
- Capability inventory: The skill leverages network requests (
fetch) and logic to render UI components based on the contents of ingested data. - Sanitization: No explicit validation, escaping, or filtering of the external data content is described in the skill instructions.
Audit Metadata