remotion-captions
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The transcribe-captions.md file provides instructions to use installWhisperCpp and downloadWhisperModel to fetch binaries and AI models from official vendor sources.
- [REMOTE_CODE_EXECUTION]: The skill includes a Node.js script template that downloads, installs, and executes the whisper.cpp binary to perform transcription.
- [INDIRECT_PROMPT_INJECTION]: The skill allows the agent to process untrusted data from audio files and .srt subtitle files. Ingestion points: transcribe() in transcribe-captions.md and parseSrt() in import-srt-captions.md. Boundary markers: None are specified in the provided code snippets to distinguish between instructions and data. Capability inventory: The skill instructions include writing to the file system via fs.writeFileSync and executing binaries through transcribe(). Sanitization: No sanitization or validation of the ingested text is demonstrated in the examples.
Audit Metadata