remotion-captions

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install external components required for transcription.
  • Fetches the Whisper.cpp engine and speech models from official sources via the @remotion/install-whisper-cpp package.
  • Recommends fetching remote .srt subtitle files for parsing and display.
  • [COMMAND_EXECUTION]: The skill instructs the user or agent to run shell commands to manage project dependencies.
  • Uses npx remotion add, bunx, yarn, and pnpm exec to install the @remotion/captions and @remotion/install-whisper-cpp packages.
  • [DYNAMIC_EXECUTION]: The skill includes scripts that perform runtime installation and configuration of executable binaries.
  • The transcribe-captions.md file demonstrates using installWhisperCpp to download and set up the transcription engine at runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a surface where untrusted external data is ingested into the application context.
  • Ingestion points: Fetches external .srt files in import-srt-captions.md and processes audio files in transcribe-captions.md.
  • Boundary markers: None identified; external text is parsed and used directly for captioning.
  • Capability inventory: Includes file system writing (fs.writeFileSync), package installation commands, and network fetching.
  • Sanitization: No explicit sanitization or validation of the content within subtitle files is demonstrated.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 01:52 PM
Security Audit — agent-trust-hub — remotion-captions