remotion-render
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
npx remotion renderandnpx remotion stillto export video and image content. These commands are the intended primary purpose of the skill. - [EXTERNAL_DOWNLOADS]: The use of
npxfacilitates the download and execution of theremotionpackage from the npm registry. As this is the official tool from the skill's author (remotion-dev), it is considered a legitimate dependency. - [INDIRECT_PROMPT_INJECTION]: The skill provides templates for shell commands that incorporate user-provided variables such as composition IDs and file paths, creating a potential surface for command injection if the agent processes malicious input.
- Ingestion points: User-supplied
[composition-id]and output directory paths are used to construct thenpx remotioncommand line inSKILL.md. - Boundary markers: No specific delimiters or "ignore instructions" warnings are provided for the interpolated variables.
- Capability inventory: The skill utilizes shell command execution (subprocess calls) to interact with the Remotion CLI.
- Sanitization: There are no explicit instructions for the agent to sanitize or validate the user-provided arguments before execution.
Audit Metadata