srt-remotion-video
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's workflow involves executing several internal Node.js scripts to manage the project lifecycle, including
init-project.js,generate-storyboard.js, andgenerate-scenes-registry.js. It also instructs the agent to runnpm installfor dependency management, andnpx remotionfor both previewing the video in a studio environment and rendering the final MP4 output. - [EXTERNAL_DOWNLOADS]: During its initialization phase, the
ensure-template-deps.jsscript checks for the presence of required libraries. If missing, it executesnpm installto download dependencies from the official NPM registry into the project template. The dependencies identified are standard industry libraries such as React and Remotion. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided SRT subtitle files, which represent an untrusted data ingestion surface. The content from these files is analyzed by SubAgents to determine scene transitions and visual content.
- Ingestion points: User-provided
srtPathprocessed inSKILL.mdandstoryboard-parser.md. - Boundary markers: The skill uses specific reference documents (
storyboard-parser.md,scene-component-creator.md) to define SubAgent tasks, though it lacks explicit 'ignore embedded instructions' delimiters for the subtitle text itself. - Capability inventory: The skill has the capability to write local files, install packages via
npm, and execute the generated code through the Remotion rendering engine. - Sanitization: The skill employs a dedicated parsing script (
generate-storyboard.js) and a structure validation script (validate-scene-plan.js) to ensure processed data conforms to expected formats before it is used in code generation.
Audit Metadata