remotion-captions

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill includes code to install and set up whisper.cpp and specific AI models using the @remotion/install-whisper-cpp library. This is a functional requirement for the transcription capabilities and utilizes official vendor-provided packages to manage the external dependency.
  • [EXTERNAL_DOWNLOADS]: The skill documentation describes fetching subtitle files (.srt) from remote URLs and downloading transcription models. These operations are transparently documented as part of the core functionality for processing video captions.
  • [COMMAND_EXECUTION]: The instructions recommend using the remotion CLI (via npx) to add necessary packages to the project. It also provides a commented-out example of using ffmpeg for media pre-processing, which are standard utilities in the video production ecosystem.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, specifically audio files for transcription and .srt files for parsing.
  • Ingestion points: Audio input files in transcribe-captions.md and remote/local SRT files in import-srt-captions.md.
  • Boundary markers: None identified in the provided implementation snippets.
  • Capability inventory: File system writing (fs.writeFileSync) and network fetching (fetch).
  • Sanitization: No specific sanitization or filtering logic is shown for the transcribed or parsed text before it is used in the video rendering logic.
  • [DYNAMIC_EXECUTION]: The library @remotion/install-whisper-cpp handles the runtime setup of the transcription environment. This dynamic configuration is localized to the vendor's specialized tools and is necessary for the skill's primary purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 12:02 AM
Security Audit — agent-trust-hub — remotion-captions