remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing official Remotion ecosystem packages (e.g., @remotion/media, @remotion/captions, @remotion/three) and utilities through standard package managers (npm, yarn, pnpm, bun).
  • [COMMAND_EXECUTION]: Provides implementation examples for audio transcription that use child_process.execSync to run FFmpeg, which is a standard procedure for media processing within the Remotion development environment.
  • [CREDENTIALS_UNSAFE]: Encourages the secure handling of API keys (such as Mapbox access tokens) by using .env files, following industry standard security practices for local development and preventing accidental exposure of secrets.
  • [PROMPT_INJECTION]: The skill includes guidance on processing external data (e.g., Lottie JSON or dynamic metadata via fetch), creating a potential surface for indirect prompt injection.
  • Ingestion points: calculateMetadata (remote data URLs), display-captions.md (external JSON), lottie.md (remote assets).
  • Boundary markers: Delimiters are absent in the examples provided.
  • Capability inventory: Utilizes fetch for data retrieval and child_process.execSync in user-facing scripts.
  • Sanitization: Specifically recommends implementing Zod schemas in rules/parameters.md to validate and sanitize dynamic data.
  • [SAFE]: The content is purely instructional, focusing on best practices for video creation and promoting safe patterns like schema validation and proper resource management.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 11:19 AM
Security Audit — agent-trust-hub — remotion-best-practices