remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing several official Remotion packages from the npm registry using the npx remotion add command. These include @remotion/three, @remotion/media, @remotion/captions, @remotion/google-fonts, @remotion/fonts, @remotion/gif, @remotion/lottie, @remotion/layout-utils, and @remotion/transitions. It also instructs the agent to fetch documentation from the official domain https://www.remotion.dev/docs/tailwind for additional context.- [COMMAND_EXECUTION]: Provides documentation on how to use the Remotion CLI for package management, specifically demonstrating the use of npx, bunx, yarn, and pnpm exec to add project dependencies.- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for ingesting and processing external data, which is a standard part of the video rendering workflow. While this introduces a data ingestion surface, the skill focuses on providing best practices for handling these assets.
  • Ingestion points: The skill provides examples for fetching and processing remote media URLs, Lottie animation JSON files, and .srt subtitle files (found in rules/lottie.md, rules/import-srt-captions.md, and rules/calculate-metadata.md).
  • Boundary markers: Not applicable as the skill provides code templates for implementation rather than processing live untrusted data within the skill execution itself.
  • Capability inventory: The documented patterns utilize network fetching (fetch), frame extraction from videos (mediabunny), and complex media rendering components.
  • Sanitization: The provided examples follow standard React patterns for prop handling; explicit sanitization logic for user-provided data URLs is left to the implementer.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 03:56 AM