remotion-upgrade

Pass

Audited by Gen Agent Trust Hub on Nov 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to upgrade project dependencies and local skills.
  • Evidence includes the use of npx remotion upgrade, npm view, and npx skills update with the --yes flag to automate the upgrade process.
  • It also uses npx remotion versions to verify the installation status.
  • [EXTERNAL_DOWNLOADS]: The skill fetches package metadata and code from the npm registry and references official GitHub resources.
  • It queries the npm registry via npm view to align dependency versions for packages like zod, mediabunny, and @huggingface/transformers.
  • It directs users to the official Remotion repository on GitHub for changelog reviews.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data that could theoretically contain malicious instructions.
  • Ingestion points: Project manifests (package.json), lockfiles, and JSON output from npm view commands.
  • Boundary markers: No explicit delimiters are used when processing these files.
  • Capability inventory: The skill can execute shell commands (npx, npm) and modify project configuration files.
  • Sanitization: No explicit sanitization or validation of the fetched package metadata is documented.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 8, 2026, 06:24 PM