remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external media and data files, creating a potential surface for indirect prompt injection.
- Ingestion points: Reads JSON captions, SRT subtitle files, and fetches dynamic data in
calculateMetadataandLottiecomponents. - Boundary markers: None explicitly used to separate untrusted data from instructions.
- Capability inventory: Uses
fetchfor network requests, executesffmpegandffprobecommands via CLI, and performs dynamic property calculations at runtime. - Sanitization: No explicit sanitization or validation logic is provided for the content of ingested files before they are used in compositions.
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install official Remotion packages (
@remotion/*) and standard libraries (zod,mapbox-gl). It also covers downloading Whisper.cpp binaries and models via established Remotion libraries for transcription tasks. - [COMMAND_EXECUTION]: The documentation includes standard CLI commands for media processing using
ffmpegandffprobe, as well as Remotion-specific development commands.
Audit Metadata