remotion-create
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run commands such as
npx create-video,npm i, andnpx remotion studio. These are standard commands for initializing and developing video projects in the Remotion ecosystem. - [EXTERNAL_DOWNLOADS]: The skill uses
npx create-video@latest, which fetches the scaffolding tool from the NPM registry. It also callsnpm ito download project dependencies. These resources are from a well-known service (NPM) and are used for their intended purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes user prompts to generate video code, which is a potential surface for indirect injection. However, this is inherent to the functionality of a code-generation skill and is managed by standard LLM guardrails.
- Ingestion points: User prompt defined in
agents/openai.yaml. - Boundary markers: Not explicitly provided in the markdown instructions.
- Capability inventory: Shell command execution (
npx,npm) and file writing. - Sanitization: No specific sanitization or filtering logic is mentioned in the provided files.
Audit Metadata