remotion-create
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
npx create-videoandnpm ito scaffold new projects and install dependencies. These are standard operations for the Remotion development environment and originate from the official vendor. - [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection as it ingests user-provided product descriptions to generate React-based video compositions.
- Ingestion points: User-supplied product information is interpolated into the project creation workflow.
- Boundary markers: None explicitly defined in the provided instructions.
- Capability inventory: Shell command execution (
npx,npm) and file system writes to the project directory. - Sanitization: No specific sanitization or validation logic is defined for the user-provided data before it influences code generation.
- [SAFE]: The instructions include a specific warning for the agent to avoid deleting meaningful hidden files such as
.envor.gitdirectories when preparing a folder for scaffolding. This demonstrates a best-practice approach to maintaining the integrity of local environment secrets and version control data.
Audit Metadata