remotion-script-writer
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONINGCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it analyzes untrusted codebase content to generate video scripts.\n
- Ingestion points: The
codeparameter inSKILL.mdandrules/prompt-structure.mdallows users to provide external file paths or repository URLs for analysis.\n - Boundary markers: No specific boundary markers or instructions to disregard embedded commands are present in
SKILL.mdorrules/script-generation.md.\n - Capability inventory: The skill produces a structured JSON script (as shown in
rules/script-generation.mdandexamples/product-demo-example.json) that controls the behavior of downstream Remotion agents.\n - Sanitization: No sanitization or content filtering is performed on the ingested codebase data before it is incorporated into the script.\n- [METADATA_POISONING]: The skill files (
README.md,package.json,SKILL.md) list 'Manus AI' as the creator, which conflicts with the 'sanky369' authorship provided in the skill context.\n- [COMMAND_EXECUTION]: TheREADME.mdprovides an installation example usingnpx skills add remotion-script-writer. This is a standard package management operation for the platform and is not considered malicious.
Audit Metadata