remotion-best-practices

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's rules explicitly fetch and ingest arbitrary remote content (e.g., calculateMetadata's example fetch(props.dataUrl) in rules/calculate-metadata.md, Lottie JSON fetch in rules/lottie.md, and numerous UrlSource/remote-URL examples in the mediabunny/get-* and media components) which the agent is expected to read/interpret and that can alter composition metadata, timing, or behavior — exposing it to untrusted third-party content that could contain instructions.