remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains standard instructions for installing Remotion-related dependencies using
npx,bunx,yarn, andpnpm. These commands are routine setup procedures for developers using the Remotion ecosystem. - [EXTERNAL_DOWNLOADS]: Code examples in the skill reference assets (Lottie JSON files, sample mp4/mp3 files) from well-known domains like
remotion.mediaandlottiefiles.com. These are documented neutrally as examples for media fetching. - [PROMPT_INJECTION]: The skill describes techniques for fetching external data which serves as a potential surface for indirect prompt injection.
- Ingestion points: Data is fetched via
fetch()inrules/calculate-metadata.md(dynamic props),rules/lottie.md(JSON data), andrules/import-srt-captions.md(SRT text). - Boundary markers: None provided in the simplified code snippets.
- Capability inventory: The skill uses
fetch()to retrieve external content for processing within React components. - Sanitization: While the examples do not demonstrate explicit data sanitization, they represent standard framework-specific methods for rendering media and do not pose a direct threat to the agent's operation.
Audit Metadata