remotion-captions

Pass

Audited by Gen Agent Trust Hub on Nov 5, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads AI models from Hugging Face for audio transcription and fetches source code for caption elements from the vendor's official domain at remotion.dev.
  • [COMMAND_EXECUTION]: Instructions provide commands to install several Node.js packages including @remotion/captions, @remotion/whisper-webgpu, mediabunny, and @huggingface/transformers via npm, bun, yarn, or pnpm.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could potentially contain malicious instructions. * Ingestion points: Ingests data from external .srt subtitle files (via fetch) and audio/video media files (via transcription). * Boundary markers: Not present; the instructions do not implement delimiters or 'ignore' instructions for the content of the processed media. * Capability inventory: Includes the ability to write files to the local system (writeFile) and perform network requests (fetch). * Sanitization: No explicit content sanitization or instruction filtering is described for the incoming subtitle or transcription data.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 5, 2026, 08:24 PM