remotion-best-practices

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's instructions explicitly fetch and ingest external, potentially untrusted resources (for example, rules/calculate-metadata.md shows calculateMetadata performing fetch(props.dataUrl) to JSON and inject it into composition props, and rules/lottie.md shows fetching Lottie JSON from assets4.lottiefiles.com), and those fetched artifacts are parsed and used to set durations/props/rendering behavior—meaning third-party content can materially influence runtime decisions.