remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill frequently instructs the agent to use command-line interfaces, including
npx,npm,yarn,pnpm, andbunfor project management and rendering tasks. Specific tools likeffmpegandffprobeare recommended for video and audio processing vianpx remotioncommands. - [EXTERNAL_DOWNLOADS]: The rules advise the agent to install various specialized Remotion packages (e.g.,
@remotion/media,@remotion/captions,@remotion/lottie) from standard package registries. - [EXTERNAL_DOWNLOADS]: Several examples involve fetching remote assets (video, audio, Lottie JSON) and metadata from well-known technology domains such as
remotion.media,lottiefiles.com, andelevenlabs.io. - [REMOTE_CODE_EXECUTION]: The audio transcription rule provides a Node.js workflow that downloads and installs the
whisper.cppbinary and language models onto the local system using official Remotion utility packages. - [CREDENTIALS_UNSAFE]: The documentation for voiceover generation correctly identifies the need for an API key (
ELEVENLABS_API_KEY) and demonstrates the secure practice of accessing it via environment variables rather than hardcoding.
Audit Metadata