remotion
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents APIs that ingest external data, creating a potential surface for indirect prompt injection if that data is malicious.
- Ingestion points:
reference.mddemonstrates the use offetch()withincalculateMetadataand thegetInputProps()hook to retrieve data from external APIs or command-line arguments. - Capability inventory: The documented framework includes capabilities for file system writes (
renderMedia), network deployments to AWS Lambda (deploySite), and dynamic code bundling (bundle). - Boundary markers: The documentation does not explicitly demonstrate the use of prompt boundary markers or directives to ignore instructions within ingested data.
- Sanitization: The provided code examples are for demonstration and do not include specific data validation or sanitization logic.
- [COMMAND_EXECUTION]:
SKILL.mdincludes instructions for running a local development server usingnpm run studio. This is a standard project command for the Remotion framework to preview video compositions.
Audit Metadata