remotion-video-creation
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides examples of ingesting untrusted external data to dynamically set composition duration, dimensions, and properties.
- Ingestion points:
rules/calculate-metadata.mdfetches data from a user-suppliedprops.dataUrl.rules/compositions.mdfetches data based on aprops.videoId.rules/tailwind.mdinstructs the agent to fetch documentation from an external URL. - Boundary markers: The provided code snippets do not implement delimiters or specific instructions for the AI to ignore instructions embedded within the fetched content.
- Capability inventory: The skill uses
fetchfor network operations and sets video metadata based on the response. - Sanitization: No input validation or content sanitization is demonstrated in the examples.
- [COMMAND_EXECUTION]: The skill includes instructions for installing official framework extensions using package managers (
npx remotion add,bunx,yarn,pnpm). These commands target official scoped packages such as@remotion/threeand@remotion/media. - [EXTERNAL_DOWNLOADS]: The skill references several remote assets from well-known domains, including Remotion's official media host and LottieFiles, for use in video compositions.
Audit Metadata