remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing several packages from the Remotion ecosystem and other utility libraries. These include official extensions such as
@remotion/three,@remotion/media,@remotion/captions,@remotion/google-fonts,@remotion/fonts,@remotion/lottie,@remotion/layout-utils,@remotion/transitions, and@remotion/zod-types, along with third-party libraries likemapbox-gl,@turf/turf,zod, andmediabunny. - [COMMAND_EXECUTION]: Provides specific shell commands for various package managers (
npm,bun,yarn,pnpm) to add dependencies and a specific render command for map animations (npx remotion render --gl=angle --concurrency=1). These are standard operational commands for the Remotion framework. - [INDIRECT_PROMPT_INJECTION]: The skill outlines patterns for fetching and processing external data from remote URLs, such as Lottie JSON files, SRT subtitle files, and dynamic metadata for compositions.
- Ingestion points:
rules/calculate-metadata.md(props.dataUrl),rules/lottie.md(external URL),rules/import-srt-captions.md(SRT files). - Boundary markers: No explicit boundary markers or delimiters for the fetched data are included in the code examples.
- Capability inventory: The examples demonstrate fetching data via standard
fetchcalls and using Remotion's internal rendering functions. - Sanitization: The provided code snippets perform standard data parsing (e.g.,
.json(),.text()) but do not include explicit sanitization of the content before it is used in the React components, which is common for development guidelines.
Audit Metadata