remotion-to-hyperframes
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes shell scripts (e.g.,
scripts/render_diff.sh,scripts/frame_strip.sh) that coordinate video processing tasks usingffmpegandffprobe. These commands are executed locally to validate the output of the translation process and are handled using secure argument passing techniques. - [DYNAMIC_EXECUTION]: Logic for analyzing video frames and calculating differences is implemented in Python scripts that are invoked by the shell scripts using heredocs. These scripts use the
subprocessmodule to interact with media utilities in a structured and safe manner to avoid shell injection. - [INDIRECT_PROMPT_INJECTION]: As the skill's primary function is to translate user-provided source code, it possesses an ingestion surface for potentially untrusted data. This risk is addressed by the inclusion of a linter (
scripts/lint_source.py) that checks the input for incompatible React patterns and complex state management before the agent begins the conversion process. - [EXTERNAL_DOWNLOADS]: The skill uses established development tools and libraries via
npx(e.g.,remotion,hyperframes,esbuild) and references assets from well-known content delivery networks (e.g., Google Fonts, cdnjs). These references are standard for the technologies involved and are used as intended for composition rendering and deployment.
Audit Metadata