remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent on installing various Remotion-specific and utility packages (e.g., @remotion/media, @remotion/three, zod, mapbox-gl) using standard package managers. It also includes instructions for downloading specialized binaries like Whisper.cpp via official packages.
- [COMMAND_EXECUTION]: Provides guidance for executing project-related commands such as remotion ffmpeg and running custom Node.js scripts for media processing tasks like transcription and voiceover generation.
- [PROMPT_INJECTION]: Indirect Prompt Injection vulnerability surface detected.
- Ingestion points: The skill facilitates fetching and processing external data from sources like SRT files, JSON captions, and Lottie animations in rules/display-captions.md, rules/import-srt-captions.md, and rules/lottie.md.
- Boundary markers: No specific delimiters or warnings to ignore embedded instructions are present in the code templates.
- Capability inventory: The skill includes scripts that perform file system write operations (writeFileSync) in rules/voiceover.md and rules/transcribe-captions.md.
- Sanitization: The provided examples do not include explicit sanitization or validation of the external content before processing.
Audit Metadata