remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing various Remotion-specific utility packages (e.g., @remotion/three, @remotion/media-utils, @remotion/captions) via standard package managers like npm, yarn, pnpm, and bun.
- [COMMAND_EXECUTION]: Instructions for media operations involve executing commands like "bunx remotion ffmpeg" and "bunx remotion ffprobe" to perform video trimming and analysis tasks.
- [REMOTE_CODE_EXECUTION]: The transcription logic utilizes @remotion/install-whisper-cpp to download and install binary components and models locally for speech-to-text processing, which is a standard procedure for this framework.
- [CREDENTIALS_SAFE]: The skill explicitly advises users to store sensitive API keys for Mapbox and ElevenLabs in a .env file and avoid hardcoding them, following industry security standards for secret management.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits surface area for indirect prompt injection as it ingests untrusted data from remote sources. * Ingestion points: Remote JSON data fetched in rules/calculate-metadata.md, Lottie animation assets in rules/lottie.md, and subtitles in rules/display-captions.md. * Boundary markers: None identified in the provided code snippets. * Capability inventory: Includes shell command execution (FFmpeg), network requests (ElevenLabs API), and local file system writes (transcription outputs). * Sanitization: No specific sanitization or validation of external data is demonstrated in the examples.
Audit Metadata