timeline-layout-reveal
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
bun,turbo, and theremotionCLI. These includebun install,bunx remotion studio, andbunx remotion render, which are standard operations for building and previewing projects within the Remotion framework. - [EXTERNAL_DOWNLOADS]: Fetches project dependencies and build tools from official registries via
bun install. It also references an external upload process to Cloudflare R2 (a well-known service) for sharing the final video output. - [INDIRECT_PROMPT_INJECTION]: The skill processes project source code and composition metadata to generate visual assets. While this represents a data ingestion surface, it does not include patterns for malicious instruction embedding, and the risk is mitigated by the specific context of rendering a development project.
Audit Metadata