remotion-video

Pass

Audited by Gen Agent Trust Hub on Mar 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes shell scripts (scripts/scaffold_project.sh and scripts/render.sh) that execute node, npm, and npx commands to manage the project lifecycle and render videos. These actions are restricted to the local development environment and the project directory.
  • [EXTERNAL_DOWNLOADS]: The scaffolding process uses npx create-video@latest to download the official Remotion project template and installs standard dependencies such as tailwindcss and @remotion/tailwind from the npm registry. These are well-known resources in the ecosystem.
  • [PROMPT_INJECTION]: The skill facilitates data-driven video creation by interpolating user-provided text and data into React components. Ingestion points: User input enters via the --props and --props-file arguments in scripts/render.sh, as well as through JSON files read in references/rules/data-driven.md. Boundary markers: The templates do not employ explicit boundary markers or 'ignore' instructions for the interpolated strings. Capability inventory: The skill's primary capability is media rendering via the Remotion CLI. Sanitization: Input strings are rendered directly into components without specific sanitization, which is typical for media generation tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 9, 2026, 08:01 AM