remotion-to-hyperframes
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions and test corpus utilize local scripts (
lint_source.py,render_diff.sh,frame_strip.sh) and standard system utilities (ffmpeg,npm,npx). These are necessary for the skill's primary functions of source code analysis, asset generation, and video rendering comparison. - [EXTERNAL_DOWNLOADS]: The skill references well-known and trusted external sources for its generated output, including GSAP and Lottie libraries from
cdnjs.cloudflare.comandunpkg.com. These are industry-standard CDNs used to provide runtime dependencies for web-based animations. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes untrusted user-provided Remotion source code. However, it incorporates a robust mitigation strategy via
scripts/lint_source.py, which identifies and blocks incompatible React patterns (such asuseState,useEffect, and third-party UI libraries) that could introduce non-deterministic behavior. The agent is explicitly instructed to refuse translation if these blockers are detected. - [DYNAMIC_EXECUTION]: The test orchestration scripts (
validate.sh,run.sh) use Python heredocs to integrate logic. These scripts are used for internal validation of the skill's logic and do not execute external untrusted code strings, relying instead on local module imports.
Audit Metadata