remotion-captions
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install external components required for transcription.
- Fetches the Whisper.cpp engine and speech models from official sources via the
@remotion/install-whisper-cpppackage. - Recommends fetching remote
.srtsubtitle files for parsing and display. - [COMMAND_EXECUTION]: The skill instructs the user or agent to run shell commands to manage project dependencies.
- Uses
npx remotion add,bunx,yarn, andpnpm execto install the@remotion/captionsand@remotion/install-whisper-cpppackages. - [DYNAMIC_EXECUTION]: The skill includes scripts that perform runtime installation and configuration of executable binaries.
- The
transcribe-captions.mdfile demonstrates usinginstallWhisperCppto download and set up the transcription engine at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface where untrusted external data is ingested into the application context.
- Ingestion points: Fetches external
.srtfiles inimport-srt-captions.mdand processes audio files intranscribe-captions.md. - Boundary markers: None identified; external text is parsed and used directly for captioning.
- Capability inventory: Includes file system writing (
fs.writeFileSync), package installation commands, and network fetching. - Sanitization: No explicit sanitization or validation of the content within subtitle files is demonstrated.
Audit Metadata