remotion-motion-graphics
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches component catalogs and documentation from the vendor's official domain at
snapcn.dev. It also utilizesnpxto download and execute theshadcnCLI and the@snapcn/mcppackage. - [COMMAND_EXECUTION]: The instructions involve executing shell commands using
npxfor adding components, rendering video frames, and configuring MCP servers. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting external data.
- Ingestion points: The skill directs the agent to fetch component metadata and documentation from
https://snapcn.dev/llms-components.txtandhttps://snapcn.dev/docs/text/*.mdwithinSKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided for the fetched content.
- Capability inventory: The skill possesses the capability to execute shell commands (
npx) for rendering and installation tasks. - Sanitization: There is no evidence of sanitization or validation for the externally fetched documentation content.
Audit Metadata