remotion-captions

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install Whisper.cpp binaries and AI models using the @remotion/install-whisper-cpp package. These downloads are required for the transcription functionality provided by the skill.
  • [COMMAND_EXECUTION]: The skill includes a script that executes transcription logic and suggests using ffmpeg via child_process.execSync to prepare audio files. These operations are local and intended for video processing.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external subtitle data, creating a potential surface for indirect prompt injection.
  • Ingestion points: Fetches and parses .srt and .json files in display-captions.md and import-srt-captions.md.
  • Boundary markers: The skill does not implement explicit boundary markers or instructions to ignore embedded commands within the caption data.
  • Capability inventory: The skill has capabilities to write to the file system (fs.writeFileSync) and execute shell commands (transcribe function).
  • Sanitization: Input is parsed into a specific, typed Caption structure by the @remotion/captions library, which limits the execution surface.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 04:43 AM
Security Audit — agent-trust-hub — remotion-captions