remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npxand other package runners to execute Remotion-specific CLI tools for project initialization, previewing, and rendering (e.g.,create-video,remotion studio,remotion still,remotion ffmpeg). - [EXTERNAL_DOWNLOADS]: The skill recommends installing numerous packages from the Remotion ecosystem and third-party libraries like
zodandmaplibre-gl. It also provides instructions for using@remotion/install-whisper-cppto download and install the Whisper C++ binary for audio transcription. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from external sources, which could potentially contain malicious instructions that influence the agent's behavior during the video creation process.
- Ingestion points: API responses fetched in
rules/calculate-metadata.md, JSON caption files inrules/display-captions.md, SRT subtitle files inrules/import-srt-captions.md, and TTS API responses inrules/voiceover.md. - Boundary markers: Absent; the skill does not specify the use of clear delimiters or instructions to ignore content within the ingested data.
- Capability inventory: The skill possesses capabilities for command execution (Remotion CLI tools), file writing (transcription output), and network operations (fetching assets and metadata).
- Sanitization: The skill recommends using Zod schemas for parameter validation as a best practice in
rules/parameters.md.
Audit Metadata