remotion-video-factory
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
child_processmodule in Node.js and thesubprocessmodule in Python to execute local CLI tools. Specifically, it callsffmpegandffprobefor audio processing and duration measurement, andnpx(remotion) for video rendering. These operations are core to the skill's functionality and are performed with appropriate argument handling. - [EXTERNAL_DOWNLOADS]: The
tts.pyscript connects to Microsoft's Edge TTS service and a custom voice cloning service atomnivoice.duckcloud.funto generate narration audio files. These network requests are used to fetch data (MP3/WAV files) and do not involve remote code execution. - [DYNAMIC_EXECUTION]: The
build-timeline.mjsscript implements a build-time code generation pattern. It reads metadata about the generated audio files and scene configurations to producesrc/timeline.tsandsrc/types.ts. These files are then imported by the React application. The script includes validation logic to ensure that generated identifiers are legitimate, mitigating potential code injection risks during the generation process.
Audit Metadata