brand-video
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
npx remotion rendercommand to generate MP4 video files. This involves running a Node.js-based CLI tool that compiles and executes TypeScript code within the project's source directory.- [PROMPT_INJECTION]: The skill includes an interface for a--scriptargument used to define video content. This constitutes an indirect prompt injection surface as untrusted script content could potentially influence downstream AI tasks like voiceover generation or scene selection. - Ingestion points: The
--scriptargument provided in the skill metadata. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present.
- Capability inventory: Shell command execution via
npxfor rendering components. - Sanitization: No sanitization or validation of the input script is documented.- [EXTERNAL_DOWNLOADS]: The use of
npxpotentially downloads theremotionpackage and its dependencies from the npm registry if they are not pre-installed in the environment.
Audit Metadata