remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Multiple rule files, including
3d.md,audio.md, andfonts.md, instruct the user to install Remotion-specific packages using thenpx remotion addcommand. This is the standard and recommended procedure for extending the framework's capabilities.- [EXTERNAL_DOWNLOADS]: Thetranscribe-captions.mdfile provides instructions to download and installWhisper.cppand its associated models for audio-to-text transcription. Additionally, rules for Lottie animations (lottie.md) and media assets (assets.md,videos.md) demonstrate fetching content from remote URLs such asassets4.lottiefiles.comandremotion.mediafor use within the video compositions.- [CREDENTIALS_UNSAFE]: Themaps.mdrule correctly advises users to store Mapbox access tokens in a.envfile. This represents a safe practice for managing credentials in development environments, preventing them from being hardcoded in the source code.- [PROMPT_INJECTION]: The skill implements surfaces for indirect prompt injection (Category 8) by fetching and processing external data to drive video content. Ingestion points: Rules likecalculate-metadata.md,display-captions.md, andlottie.mdingest data from external JSON or SRT sources viafetch(). Boundary markers: No specific delimiters or safety warnings for untrusted data are provided in the code snippets. Capability inventory: The retrieved data is used to transform component props and composition metadata, influencing the final rendered output. Sanitization: The provided examples do not explicitly demonstrate sanitization or validation of the ingested data, as they focus on functional implementation. These patterns are essential for the operation of the framework and are not used maliciously in this context.
Audit Metadata