remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install various official packages from the
@remotionscope (e.g.,@remotion/three,@remotion/media,@remotion/captions, etc.) and themediabunnyutility using standard package managers. - [COMMAND_EXECUTION]: Rule files contain shell commands for project dependency management (e.g.,
npx remotion add ...). These are standard developer workflow instructions for adding functionality to a Remotion project. - [PROMPT_INJECTION]: The skill demonstrates patterns for fetching and processing external data, creating a surface for indirect prompt injection.
- Ingestion points: Files
calculate-metadata.md,compositions.md,import-srt-captions.md, andlottie.mddescribe patterns for fetching external data (JSON, SRT, Lottie assets).tailwind.mdinstructs the agent to fetch documentation from an external site. - Boundary markers: None. The provided code snippets do not include explicit boundary markers or instructions to ignore embedded commands in the fetched data.
- Capability inventory: Processing is confined to
fetchoperations and the Remotion rendering environment; no direct shell execution capabilities are exposed to the content of the fetched data. - Sanitization: Examples do not demonstrate validation or sanitization of the fetched external content before it is processed or used to populate component props.
Audit Metadata