srt-remotion-video

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill's workflow involves executing several internal Node.js scripts to manage the project lifecycle, including init-project.js, generate-storyboard.js, and generate-scenes-registry.js. It also instructs the agent to run npm install for dependency management, and npx remotion for both previewing the video in a studio environment and rendering the final MP4 output.
  • [EXTERNAL_DOWNLOADS]: During its initialization phase, the ensure-template-deps.js script checks for the presence of required libraries. If missing, it executes npm install to download dependencies from the official NPM registry into the project template. The dependencies identified are standard industry libraries such as React and Remotion.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided SRT subtitle files, which represent an untrusted data ingestion surface. The content from these files is analyzed by SubAgents to determine scene transitions and visual content.
  • Ingestion points: User-provided srtPath processed in SKILL.md and storyboard-parser.md.
  • Boundary markers: The skill uses specific reference documents (storyboard-parser.md, scene-component-creator.md) to define SubAgent tasks, though it lacks explicit 'ignore embedded instructions' delimiters for the subtitle text itself.
  • Capability inventory: The skill has the capability to write local files, install packages via npm, and execute the generated code through the Remotion rendering engine.
  • Sanitization: The skill employs a dedicated parsing script (generate-storyboard.js) and a structure validation script (validate-scene-plan.js) to ensure processed data conforms to expected formats before it is used in code generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 02:30 PM