remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions in rules/transcribe-captions.md for a Node.js script that uses @remotion/install-whisper-cpp to download and install the whisper.cpp binary and associated models.
  • [EXTERNAL_DOWNLOADS]: The skill references several external resources and APIs, including ElevenLabs TTS (rules/voiceover.md), Lottie animation assets (rules/lottie.md), and Mapbox styles (rules/maps.md). These are standard integrations for the framework's functionality.
  • [DATA_INGESTION_SURFACE]: The skill utilizes calculateMetadata functions that fetch data from external URLs to dynamically define composition properties, which represents a data ingestion surface.
  • Ingestion points: Data enters through fetch() calls within the calculateMetadata lifecycle method and useDelayRender hooks in rules/calculate-metadata.md, rules/compositions.md, and rules/display-captions.md.
  • Boundary markers: No explicit delimiters are present; however, data is expected to be in structured JSON format.
  • Capability inventory: The environment supports network access for asset fetching and subprocess execution for video processing via ffmpeg (as documented in rules/ffmpeg.md).
  • Sanitization: The instructions assume TypeScript type safety but do not explicitly detail runtime schema validation beyond basic JSON parsing.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 06:34 PM