remotion-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches versioning information from the npm registry using
npm viewand retrieves compatibility guidelines fromremotion.dev. These sources are well-known service registries or official vendor domains. - [COMMAND_EXECUTION]: Executes shell commands via
npxto run the Remotion CLI (remotion upgrade) and a skill management tool (skills update). These operations are necessary for the skill's stated purpose of upgrading software and related assets. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, including project manifest files (package.json), lockfiles, and web-based documentation. While reading untrusted data presents a surface for potential instruction injection, the risk is mitigated as the ingested content comes from the user's local project or the vendor's official documentation, and the agent uses this data specifically for dependency version matching.
Audit Metadata