remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from external URLs using the fetch API within the calculateMetadata lifecycle and during the loading of assets like Lottie animations and captions. This data is used to dynamically define video properties such as duration, dimensions, and visual props, creating a surface where malicious external content could influence agent processing. Specific ingestion points are found in rules/calculate-metadata.md, rules/display-captions.md, and rules/lottie.md. The provided examples do not include explicit boundary markers or sanitization logic. The skill capability inventory includes network operations, CLI tool execution, and file system writes.
  • [EXTERNAL_DOWNLOADS]: The documentation instructs users on how to install various official Remotion packages and third-party dependencies like mapbox-gl and @turf/turf using standard package managers.
  • [COMMAND_EXECUTION]: The guidelines include numerous CLI commands for project scaffolding, studio previewing, and final video rendering, which are part of the standard Remotion workflow.
  • [REMOTE_CODE_EXECUTION]: The rules/transcribe-captions.md rule provides a script that uses the @remotion/install-whisper-cpp package to automate the local installation of binary components and models for the whisper.cpp engine.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 11:06 AM