update-remotion-rust-ffmpeg
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage the build lifecycle, including
cargo update,bun install,bun run build, andgitoperations. These are standard operations for the intended purpose of a development and build automation tool. - [EXTERNAL_DOWNLOADS]: The skill fetches data and code updates from the
remotion-dev/rust-ffmpegrepository. These references target the vendor's own infrastructure and are used to synchronize dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data by reading
Cargo.tomlfiles from specific Git commits to verify versioning. This represents a potential ingestion surface, but the skill includes validation steps such as ensuring the commit is reachable from the repository's main branch. - [SAFE]: The presence of a hardcoded local path (
/Users/jonathanburger/remotion) appears to be environment-specific metadata for the author's workflow rather than a malicious indicator. The skill follows best practices by using draft pull requests and performing binary integrity checks (e.g., verifyingmsvcrt.dllimports).
Audit Metadata