remotion-video-factory

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the child_process module in Node.js and the subprocess module in Python to execute local CLI tools. Specifically, it calls ffmpeg and ffprobe for audio processing and duration measurement, and npx (remotion) for video rendering. These operations are core to the skill's functionality and are performed with appropriate argument handling.
  • [EXTERNAL_DOWNLOADS]: The tts.py script connects to Microsoft's Edge TTS service and a custom voice cloning service at omnivoice.duckcloud.fun to generate narration audio files. These network requests are used to fetch data (MP3/WAV files) and do not involve remote code execution.
  • [DYNAMIC_EXECUTION]: The build-timeline.mjs script implements a build-time code generation pattern. It reads metadata about the generated audio files and scene configurations to produce src/timeline.ts and src/types.ts. These files are then imported by the React application. The script includes validation logic to ensure that generated identifiers are legitimate, mitigating potential code injection risks during the generation process.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:49 PM