remotion

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill documents APIs that ingest external data, creating a potential surface for indirect prompt injection if that data is malicious.
  • Ingestion points: reference.md demonstrates the use of fetch() within calculateMetadata and the getInputProps() hook to retrieve data from external APIs or command-line arguments.
  • Capability inventory: The documented framework includes capabilities for file system writes (renderMedia), network deployments to AWS Lambda (deploySite), and dynamic code bundling (bundle).
  • Boundary markers: The documentation does not explicitly demonstrate the use of prompt boundary markers or directives to ignore instructions within ingested data.
  • Sanitization: The provided code examples are for demonstration and do not include specific data validation or sanitization logic.
  • [COMMAND_EXECUTION]: SKILL.md includes instructions for running a local development server using npm run studio. This is a standard project command for the Remotion framework to preview video compositions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:50 PM