remotion-launch-video

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to gather inputs from external sources such as launch posts, landing pages, or one-pagers to build the video storyboard. This creates a surface for indirect prompt injection where malicious instructions embedded in the brief could influence agent behavior.\n
  • Ingestion points: Workflow Step 1 (Gather inputs) identifies external briefs and landing pages as primary data sources.\n
  • Boundary markers: No delimiters or warnings to ignore embedded instructions are specified for the external content.\n
  • Capability inventory: The skill utilizes npx shadcn for code installation, npx remotion for rendering, and ffmpeg for media processing (SKILL.md).\n
  • Sanitization: No validation or sanitization of the external brief content is described.\n- [REMOTE_CODE_EXECUTION]: The skill utilizes npx shadcn@latest add to install components from the @snapcn registry and npx -y @snapcn/mcp@latest to install an MCP server. These are vendor-provided packages and tools.\n- [EXTERNAL_DOWNLOADS]: The skill fetches component lists and documentation from the author's domain at https://snapcn.dev/llms-components.txt and related subdirectories.\n- [COMMAND_EXECUTION]: The skill involves the execution of various CLI tools including npx create-video, npm i @remotion/transitions, npx remotion render, and ffmpeg to initialize projects, manage dependencies, and render video assets.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 02:51 PM