remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for fetching and processing external data sources which are subsequently used to drive video composition properties. This creates a potential surface for indirect prompt injection where instructions embedded in external files could influence the agent.
- Ingestion points: Found in
rules/calculate-metadata.md(ingesting JSON fromprops.dataUrl),rules/display-captions.md(fetching caption JSON files viastaticFile), andrules/lottie.md(loading remote Lottie animation data). - Boundary markers: No explicit boundary markers or instructions to ignore embedded content are provided in the implementation examples.
- Capability inventory: The skill utilizes
fetchfor network requests,writeFileSyncfor local file generation in transcription scripts, and shell execution viaffmpegandffprobeutilities. - Sanitization: Examples demonstrate basic JSON parsing and usage without explicit input validation or sanitization of the content fetched from remote URLs.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing various libraries and downloading external assets.
- Fetches packages from the
@remotionorganization, such as@remotion/three,@remotion/media, and@remotion/captions. - Downloads the Whisper.cpp binary and associated models for audio transcription using the
@remotion/install-whisper-cpputility as seen inrules/transcribe-captions.md. - Suggests third-party sound effect resources from a public GitHub repository in
rules/sfx.md. - [COMMAND_EXECUTION]: The skill provides patterns for executing system commands.
- Includes usage examples for
ffmpegandffprobeviabunx remotionfor video processing tasks like trimming and format inspection inrules/ffmpeg.md. - Contains instructions for using package managers (npm, bun, yarn, pnpm) to add project dependencies and execute CLI tools.
Audit Metadata