remotion-render

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using npx remotion render and npx remotion still to export video and image content. These commands are the intended primary purpose of the skill.
  • [EXTERNAL_DOWNLOADS]: The use of npx facilitates the download and execution of the remotion package from the npm registry. As this is the official tool from the skill's author (remotion-dev), it is considered a legitimate dependency.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides templates for shell commands that incorporate user-provided variables such as composition IDs and file paths, creating a potential surface for command injection if the agent processes malicious input.
  • Ingestion points: User-supplied [composition-id] and output directory paths are used to construct the npx remotion command line in SKILL.md.
  • Boundary markers: No specific delimiters or "ignore instructions" warnings are provided for the interpolated variables.
  • Capability inventory: The skill utilizes shell command execution (subprocess calls) to interact with the Remotion CLI.
  • Sanitization: There are no explicit instructions for the agent to sanitize or validate the user-provided arguments before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 11:19 AM