remotion-upgrade
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to upgrade project dependencies and local skills.
- Evidence includes the use of
npx remotion upgrade,npm view, andnpx skills updatewith the--yesflag to automate the upgrade process. - It also uses
npx remotion versionsto verify the installation status. - [EXTERNAL_DOWNLOADS]: The skill fetches package metadata and code from the npm registry and references official GitHub resources.
- It queries the npm registry via
npm viewto align dependency versions for packages likezod,mediabunny, and@huggingface/transformers. - It directs users to the official Remotion repository on GitHub for changelog reviews.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data that could theoretically contain malicious instructions.
- Ingestion points: Project manifests (
package.json), lockfiles, and JSON output fromnpm viewcommands. - Boundary markers: No explicit delimiters are used when processing these files.
- Capability inventory: The skill can execute shell commands (
npx,npm) and modify project configuration files. - Sanitization: No explicit sanitization or validation of the fetched package metadata is documented.
Audit Metadata