remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Mar 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to install various official packages from the @remotion scope (e.g., @remotion/three, @remotion/media, @remotion/captions, etc.) and the mediabunny utility using standard package managers.
  • [COMMAND_EXECUTION]: Rule files contain shell commands for project dependency management (e.g., npx remotion add ...). These are standard developer workflow instructions for adding functionality to a Remotion project.
  • [PROMPT_INJECTION]: The skill demonstrates patterns for fetching and processing external data, creating a surface for indirect prompt injection.
  • Ingestion points: Files calculate-metadata.md, compositions.md, import-srt-captions.md, and lottie.md describe patterns for fetching external data (JSON, SRT, Lottie assets). tailwind.md instructs the agent to fetch documentation from an external site.
  • Boundary markers: None. The provided code snippets do not include explicit boundary markers or instructions to ignore embedded commands in the fetched data.
  • Capability inventory: Processing is confined to fetch operations and the Remotion rendering environment; no direct shell execution capabilities are exposed to the content of the fetched data.
  • Sanitization: Examples do not demonstrate validation or sanitization of the fetched external content before it is processed or used to populate component props.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 26, 2026, 08:45 PM