remotion
Pass
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Uses Bash to manage the video project lifecycle, including project initialization with
npm create video, dependency installation, and rendering withnpx remotion render. - [EXTERNAL_DOWNLOADS]: Downloads design assets such as screenshots and HTML metadata from Google Cloud Storage (
storage.googleapis.com), which is a well-known and trusted infrastructure service. - [COMMAND_EXECUTION]: Includes a dedicated shell script
scripts/download-stitch-asset.shthat usescurlto retrieve assets from remote URLs provided by the Stitch design platform. - [PROMPT_INJECTION]: Implements an indirect prompt injection surface by processing and rendering text-based metadata (screen titles and descriptions) from an external design platform, though this is a functional requirement of the video generation process.
Audit Metadata