remotion-captions
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes code to install and set up
whisper.cppand specific AI models using the@remotion/install-whisper-cpplibrary. This is a functional requirement for the transcription capabilities and utilizes official vendor-provided packages to manage the external dependency. - [EXTERNAL_DOWNLOADS]: The skill documentation describes fetching subtitle files (.srt) from remote URLs and downloading transcription models. These operations are transparently documented as part of the core functionality for processing video captions.
- [COMMAND_EXECUTION]: The instructions recommend using the
remotionCLI (vianpx) to add necessary packages to the project. It also provides a commented-out example of usingffmpegfor media pre-processing, which are standard utilities in the video production ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, specifically audio files for transcription and
.srtfiles for parsing. - Ingestion points: Audio input files in
transcribe-captions.mdand remote/local SRT files inimport-srt-captions.md. - Boundary markers: None identified in the provided implementation snippets.
- Capability inventory: File system writing (
fs.writeFileSync) and network fetching (fetch). - Sanitization: No specific sanitization or filtering logic is shown for the transcribed or parsed text before it is used in the video rendering logic.
- [DYNAMIC_EXECUTION]: The library
@remotion/install-whisper-cpphandles the runtime setup of the transcription environment. This dynamic configuration is localized to the vendor's specialized tools and is necessary for the skill's primary purpose.
Audit Metadata