remotion-video-toolkit

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates downloading media assets (images, videos, audio) from remote URLs, including official Remotion media servers and LottieFiles assets. It also directs the agent to fetch documentation from the official Remotion website.
  • [COMMAND_EXECUTION]: Provides instructions for using standard CLI tools such as npx, npm, pnpm, yarn, and bun to scaffold projects, manage dependencies (using remotion add), and execute rendering tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill documents the use of calculateMetadata and prop fetching to drive video content from external data sources. This constitutes a potential ingestion surface for untrusted data.
  • Ingestion points: calculateMetadata calls to external APIs and user-supplied props.dataUrl (documented in rules/calculate-metadata.md and rules/compositions.md).
  • Boundary markers: None explicitly defined in the example snippets, which rely on standard JSON response parsing.
  • Capability inventory: The toolkit can perform network requests, file writes via rendering, and execute shell commands for project management.
  • Sanitization: Not demonstrated in the provided examples; the skill assumes the fetched data is valid for processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 11:32 PM
Security Audit — agent-trust-hub — remotion-video-toolkit