remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions in
rules/transcribe-captions.mdfor a Node.js script that uses@remotion/install-whisper-cppto download and install thewhisper.cppbinary and associated models. - [EXTERNAL_DOWNLOADS]: The skill references several external resources and APIs, including ElevenLabs TTS (
rules/voiceover.md), Lottie animation assets (rules/lottie.md), and Mapbox styles (rules/maps.md). These are standard integrations for the framework's functionality. - [DATA_INGESTION_SURFACE]: The skill utilizes
calculateMetadatafunctions that fetch data from external URLs to dynamically define composition properties, which represents a data ingestion surface. - Ingestion points: Data enters through
fetch()calls within thecalculateMetadatalifecycle method anduseDelayRenderhooks inrules/calculate-metadata.md,rules/compositions.md, andrules/display-captions.md. - Boundary markers: No explicit delimiters are present; however, data is expected to be in structured JSON format.
- Capability inventory: The environment supports network access for asset fetching and subprocess execution for video processing via
ffmpeg(as documented inrules/ffmpeg.md). - Sanitization: The instructions assume TypeScript type safety but do not explicitly detail runtime schema validation beyond basic JSON parsing.
Audit Metadata