remotion-upgrade

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches versioning information from the npm registry using npm view and retrieves compatibility guidelines from remotion.dev. These sources are well-known service registries or official vendor domains.
  • [COMMAND_EXECUTION]: Executes shell commands via npx to run the Remotion CLI (remotion upgrade) and a skill management tool (skills update). These operations are necessary for the skill's stated purpose of upgrading software and related assets.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, including project manifest files (package.json), lockfiles, and web-based documentation. While reading untrusted data presents a surface for potential instruction injection, the risk is mitigated as the ingested content comes from the user's local project or the vendor's official documentation, and the agent uses this data specifically for dependency version matching.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 06:35 PM
Security Audit — agent-trust-hub — remotion-upgrade