remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from external URLs using the
fetchAPI within thecalculateMetadatalifecycle and during the loading of assets like Lottie animations and captions. This data is used to dynamically define video properties such as duration, dimensions, and visual props, creating a surface where malicious external content could influence agent processing. Specific ingestion points are found inrules/calculate-metadata.md,rules/display-captions.md, andrules/lottie.md. The provided examples do not include explicit boundary markers or sanitization logic. The skill capability inventory includes network operations, CLI tool execution, and file system writes. - [EXTERNAL_DOWNLOADS]: The documentation instructs users on how to install various official Remotion packages and third-party dependencies like
mapbox-gland@turf/turfusing standard package managers. - [COMMAND_EXECUTION]: The guidelines include numerous CLI commands for project scaffolding, studio previewing, and final video rendering, which are part of the standard Remotion workflow.
- [REMOTE_CODE_EXECUTION]: The
rules/transcribe-captions.mdrule provides a script that uses the@remotion/install-whisper-cpppackage to automate the local installation of binary components and models for thewhisper.cppengine.
Audit Metadata