remotion-create
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx create-video@latestto download and run the project scaffolding tool from the NPM registry, which is standard for Remotion projects. - [COMMAND_EXECUTION]: The instructions involve executing shell commands including
npm ifor dependency installation,rmfor cleanup of metadata files like.DS_Store, andnpx remotion studioto start a local development server. These are routine development tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided content to generate video layouts, creating a potential surface for indirect instructions. 1. Ingestion points: User-provided product descriptions and promo details. 2. Boundary markers: None explicitly defined in the markdown instructions. 3. Capability inventory: Shell command execution (npx, npm), local file system access, and local network server hosting. 4. Sanitization: Not explicitly addressed in the provided instructions, though standard React practices are implied by the framework.
Audit Metadata