remotion-create

Pass

Audited by Gen Agent Trust Hub on Nov 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes npx create-video and npm i to scaffold new projects and install dependencies. These are standard operations for the Remotion development environment and originate from the official vendor.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection as it ingests user-provided product descriptions to generate React-based video compositions.
  • Ingestion points: User-supplied product information is interpolated into the project creation workflow.
  • Boundary markers: None explicitly defined in the provided instructions.
  • Capability inventory: Shell command execution (npx, npm) and file system writes to the project directory.
  • Sanitization: No specific sanitization or validation logic is defined for the user-provided data before it influences code generation.
  • [SAFE]: The instructions include a specific warning for the agent to avoid deleting meaningful hidden files such as .env or .git directories when preparing a folder for scaffolding. This demonstrates a best-practice approach to maintaining the integrity of local environment secrets and version control data.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 8, 2026, 06:24 PM