remotion-video-creation
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides examples of fetching assets and configuration data from external sources such as
remotion.media,lottiefiles.com, and official documentation fromremotion.dev. These are standard operations for a video creation framework to retrieve remote media assets, JSON animation data, or subtitle files. - [COMMAND_EXECUTION]: Several rule files (e.g.,
rules/3d.md,rules/audio.md,rules/fonts.md) include instructions for adding official Remotion ecosystem packages using standard package managers (npm, bun, yarn, pnpm). Examples includenpx remotion add @remotion/threeandnpx remotion add @remotion/media. These commands are standard development practices for the framework. - [DATA_EXFILTRATION]: No patterns of sensitive data access (such as credentials, SSH keys, or environment files) or exfiltration were found. Network operations are limited to fetching public assets or data provided via user props for video rendering purposes.
- [PROMPT_INJECTION]: The skill content consists of technical documentation and code snippets. There are no attempts to override agent behavior, bypass safety filters, or extract system prompts.
- [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for fetching external data (JSON, SRT) based on user-provided properties (
props.dataUrl,props.videoSrc). While this represents a surface for processing untrusted data, the code examples are for calculating video metadata and rendering UI, and do not demonstrate exploitable capabilities like arbitrary command execution or evaluation.
Audit Metadata