remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for fetching and processing external data sources which are subsequently used to drive video composition properties. This creates a potential surface for indirect prompt injection where instructions embedded in external files could influence the agent.
  • Ingestion points: Found in rules/calculate-metadata.md (ingesting JSON from props.dataUrl), rules/display-captions.md (fetching caption JSON files via staticFile), and rules/lottie.md (loading remote Lottie animation data).
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded content are provided in the implementation examples.
  • Capability inventory: The skill utilizes fetch for network requests, writeFileSync for local file generation in transcription scripts, and shell execution via ffmpeg and ffprobe utilities.
  • Sanitization: Examples demonstrate basic JSON parsing and usage without explicit input validation or sanitization of the content fetched from remote URLs.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing various libraries and downloading external assets.
  • Fetches packages from the @remotion organization, such as @remotion/three, @remotion/media, and @remotion/captions.
  • Downloads the Whisper.cpp binary and associated models for audio transcription using the @remotion/install-whisper-cpp utility as seen in rules/transcribe-captions.md.
  • Suggests third-party sound effect resources from a public GitHub repository in rules/sfx.md.
  • [COMMAND_EXECUTION]: The skill provides patterns for executing system commands.
  • Includes usage examples for ffmpeg and ffprobe via bunx remotion for video processing tasks like trimming and format inspection in rules/ffmpeg.md.
  • Contains instructions for using package managers (npm, bun, yarn, pnpm) to add project dependencies and execute CLI tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 06:56 PM