remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Mar 31, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: Multiple rule files, including 3d.md, audio.md, and fonts.md, instruct the user to install Remotion-specific packages using the npx remotion add command. This is the standard and recommended procedure for extending the framework's capabilities.- [EXTERNAL_DOWNLOADS]: The transcribe-captions.md file provides instructions to download and install Whisper.cpp and its associated models for audio-to-text transcription. Additionally, rules for Lottie animations (lottie.md) and media assets (assets.md, videos.md) demonstrate fetching content from remote URLs such as assets4.lottiefiles.com and remotion.media for use within the video compositions.- [CREDENTIALS_UNSAFE]: The maps.md rule correctly advises users to store Mapbox access tokens in a .env file. This represents a safe practice for managing credentials in development environments, preventing them from being hardcoded in the source code.- [PROMPT_INJECTION]: The skill implements surfaces for indirect prompt injection (Category 8) by fetching and processing external data to drive video content. Ingestion points: Rules like calculate-metadata.md, display-captions.md, and lottie.md ingest data from external JSON or SRT sources via fetch(). Boundary markers: No specific delimiters or safety warnings for untrusted data are provided in the code snippets. Capability inventory: The retrieved data is used to transform component props and composition metadata, influencing the final rendered output. Sanitization: The provided examples do not explicitly demonstrate sanitization or validation of the ingested data, as they focus on functional implementation. These patterns are essential for the operation of the framework and are not used maliciously in this context.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 31, 2026, 04:01 AM