remotion-create

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx create-video@latest to download and run the project scaffolding tool from the NPM registry, which is standard for Remotion projects.
  • [COMMAND_EXECUTION]: The instructions involve executing shell commands including npm i for dependency installation, rm for cleanup of metadata files like .DS_Store, and npx remotion studio to start a local development server. These are routine development tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided content to generate video layouts, creating a potential surface for indirect instructions. 1. Ingestion points: User-provided product descriptions and promo details. 2. Boundary markers: None explicitly defined in the markdown instructions. 3. Capability inventory: Shell command execution (npx, npm), local file system access, and local network server hosting. 4. Sanitization: Not explicitly addressed in the provided instructions, though standard React practices are implied by the framework.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 11:44 AM
Security Audit — agent-trust-hub — remotion-create