remotion-video-toolkit
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates downloading media assets (images, videos, audio) from remote URLs, including official Remotion media servers and LottieFiles assets. It also directs the agent to fetch documentation from the official Remotion website.
- [COMMAND_EXECUTION]: Provides instructions for using standard CLI tools such as
npx,npm,pnpm,yarn, andbunto scaffold projects, manage dependencies (usingremotion add), and execute rendering tasks. - [INDIRECT_PROMPT_INJECTION]: The skill documents the use of
calculateMetadataand prop fetching to drive video content from external data sources. This constitutes a potential ingestion surface for untrusted data. - Ingestion points:
calculateMetadatacalls to external APIs and user-suppliedprops.dataUrl(documented inrules/calculate-metadata.mdandrules/compositions.md). - Boundary markers: None explicitly defined in the example snippets, which rely on standard JSON response parsing.
- Capability inventory: The toolkit can perform network requests, file writes via rendering, and execute shell commands for project management.
- Sanitization: Not demonstrated in the provided examples; the skill assumes the fetched data is valid for processing.
Audit Metadata