remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing official Remotion ecosystem packages (e.g.,
@remotion/media,@remotion/captions,@remotion/three) and utilities through standard package managers (npm, yarn, pnpm, bun). - [COMMAND_EXECUTION]: Provides implementation examples for audio transcription that use
child_process.execSyncto run FFmpeg, which is a standard procedure for media processing within the Remotion development environment. - [CREDENTIALS_UNSAFE]: Encourages the secure handling of API keys (such as Mapbox access tokens) by using
.envfiles, following industry standard security practices for local development and preventing accidental exposure of secrets. - [PROMPT_INJECTION]: The skill includes guidance on processing external data (e.g., Lottie JSON or dynamic metadata via
fetch), creating a potential surface for indirect prompt injection. - Ingestion points:
calculateMetadata(remote data URLs),display-captions.md(external JSON),lottie.md(remote assets). - Boundary markers: Delimiters are absent in the examples provided.
- Capability inventory: Utilizes
fetchfor data retrieval andchild_process.execSyncin user-facing scripts. - Sanitization: Specifically recommends implementing Zod schemas in
rules/parameters.mdto validate and sanitize dynamic data. - [SAFE]: The content is purely instructional, focusing on best practices for video creation and promoting safe patterns like schema validation and proper resource management.
Audit Metadata