remotion-launch-video
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to gather inputs from external sources such as launch posts, landing pages, or one-pagers to build the video storyboard. This creates a surface for indirect prompt injection where malicious instructions embedded in the brief could influence agent behavior.\n
- Ingestion points: Workflow Step 1 (Gather inputs) identifies external briefs and landing pages as primary data sources.\n
- Boundary markers: No delimiters or warnings to ignore embedded instructions are specified for the external content.\n
- Capability inventory: The skill utilizes
npx shadcnfor code installation,npx remotionfor rendering, andffmpegfor media processing (SKILL.md).\n - Sanitization: No validation or sanitization of the external brief content is described.\n- [REMOTE_CODE_EXECUTION]: The skill utilizes
npx shadcn@latest addto install components from the@snapcnregistry andnpx -y @snapcn/mcp@latestto install an MCP server. These are vendor-provided packages and tools.\n- [EXTERNAL_DOWNLOADS]: The skill fetches component lists and documentation from the author's domain athttps://snapcn.dev/llms-components.txtand related subdirectories.\n- [COMMAND_EXECUTION]: The skill involves the execution of various CLI tools includingnpx create-video,npm i @remotion/transitions,npx remotion render, andffmpegto initialize projects, manage dependencies, and render video assets.
Audit Metadata