remotion-captions
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install Whisper.cpp binaries and AI models using the
@remotion/install-whisper-cpppackage. These downloads are required for the transcription functionality provided by the skill. - [COMMAND_EXECUTION]: The skill includes a script that executes transcription logic and suggests using
ffmpegviachild_process.execSyncto prepare audio files. These operations are local and intended for video processing. - [INDIRECT_PROMPT_INJECTION]: The skill processes external subtitle data, creating a potential surface for indirect prompt injection.
- Ingestion points: Fetches and parses
.srtand.jsonfiles indisplay-captions.mdandimport-srt-captions.md. - Boundary markers: The skill does not implement explicit boundary markers or instructions to ignore embedded commands within the caption data.
- Capability inventory: The skill has capabilities to write to the file system (
fs.writeFileSync) and execute shell commands (transcribefunction). - Sanitization: Input is parsed into a specific, typed
Captionstructure by the@remotion/captionslibrary, which limits the execution surface.
Audit Metadata