remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing official Remotion ecosystem packages (e.g., @remotion/media, @remotion/three, @remotion/captions, @remotion/lottie) using various package managers like npm, pnpm, and yarn. These downloads target the official registry for a well-known tool.
- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for ingesting untrusted data from external sources, which constitutes a potential attack surface:
- Ingestion points:
CalculateMetadataFunctioninrules/calculate-metadata.mdandrules/compositions.mdfetches data from URLs;fetch()is used for Lottie data inrules/lottie.mdand subtitle files inrules/import-srt-captions.md. - Boundary markers: The provided examples do not include delimiters or instructions to ignore embedded commands in the fetched data.
- Capability inventory: The skill utilizes network requests (
fetch), file access (staticFile), and dynamic rendering based on the ingested data. - Sanitization: No explicit sanitization or validation of the fetched external content is demonstrated in the code snippets.
Audit Metadata