remotion-render
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides templates for executing
npx remotion renderandnpx remotion stillcommands. These are legitimate operations for the primary purpose of video rendering using the vendor's toolset. - [INDIRECT_PROMPT_INJECTION]: The skill instructions facilitate a vulnerability surface where untrusted data could influence command execution.
- Ingestion points: User-provided parameters such as composition-id, output file names, and frame numbers in
SKILL.mdandtransparent-videos.md. - Boundary markers: The skill lacks explicit delimiters or instructions to ignore potential commands embedded within user-supplied input strings.
- Capability inventory: The agent is instructed to perform shell command execution via
npxas detailed inSKILL.md. - Sanitization: There are no specific instructions or mechanisms provided within the skill to sanitize or validate external user input before it is interpolated into the CLI commands.
Audit Metadata