remotion-video
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes shell scripts (
scripts/scaffold_project.shandscripts/render.sh) that execute node, npm, and npx commands to manage the project lifecycle and render videos. These actions are restricted to the local development environment and the project directory. - [EXTERNAL_DOWNLOADS]: The scaffolding process uses
npx create-video@latestto download the official Remotion project template and installs standard dependencies such astailwindcssand@remotion/tailwindfrom the npm registry. These are well-known resources in the ecosystem. - [PROMPT_INJECTION]: The skill facilitates data-driven video creation by interpolating user-provided text and data into React components. Ingestion points: User input enters via the
--propsand--props-filearguments inscripts/render.sh, as well as through JSON files read inreferences/rules/data-driven.md. Boundary markers: The templates do not employ explicit boundary markers or 'ignore' instructions for the interpolated strings. Capability inventory: The skill's primary capability is media rendering via the Remotion CLI. Sanitization: Input strings are rendered directly into components without specific sanitization, which is typical for media generation tools.
Audit Metadata