remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing several official Remotion packages from the npm registry using the
npx remotion addcommand. These include@remotion/three,@remotion/media,@remotion/captions,@remotion/google-fonts,@remotion/fonts,@remotion/gif,@remotion/lottie,@remotion/layout-utils, and@remotion/transitions. It also instructs the agent to fetch documentation from the official domainhttps://www.remotion.dev/docs/tailwindfor additional context.- [COMMAND_EXECUTION]: Provides documentation on how to use the Remotion CLI for package management, specifically demonstrating the use ofnpx,bunx,yarn, andpnpm execto add project dependencies.- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for ingesting and processing external data, which is a standard part of the video rendering workflow. While this introduces a data ingestion surface, the skill focuses on providing best practices for handling these assets. - Ingestion points: The skill provides examples for fetching and processing remote media URLs, Lottie animation JSON files, and
.srtsubtitle files (found inrules/lottie.md,rules/import-srt-captions.md, andrules/calculate-metadata.md). - Boundary markers: Not applicable as the skill provides code templates for implementation rather than processing live untrusted data within the skill execution itself.
- Capability inventory: The documented patterns utilize network fetching (
fetch), frame extraction from videos (mediabunny), and complex media rendering components. - Sanitization: The provided examples follow standard React patterns for prop handling; explicit sanitization logic for user-provided data URLs is left to the implementer.
Audit Metadata