remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill describes patterns that ingest untrusted data from external sources, presenting a surface for indirect prompt injection where malicious external content could influence agent-driven logic or video content.
- Ingestion points:
rules/calculate-metadata.md: Suggests fetching data from a dynamicprops.dataUrlto populate composition properties.rules/compositions.md: Demonstrates fetching video data from an external API.rules/import-srt-captions.md: Provides a pattern for fetching and parsing.srtfiles from local or remote URLs.- Boundary markers: None identified in the provided patterns to distinguish between data and instructions.
- Capability inventory: The skill defines the rendering environment for videos, where ingested data determines props, dimensions, and text content.
- Sanitization: No validation or sanitization routines for the fetched data are included in the examples.
- [EXTERNAL_DOWNLOADS]: The skill recommends installing various official extensions from the Remotion ecosystem and fetching assets or documentation from remote domains.
- Installation commands are provided for
@remotion/three,@remotion/media,@remotion/captions,@remotion/google-fonts,@remotion/fonts,@remotion/gif,@remotion/layout-utils, and@remotion/transitions. - The skill also references remote assets from
assets4.lottiefiles.comand documentation fromwww.remotion.dev. - [COMMAND_EXECUTION]: The skill provides standard shell commands for package management in a Remotion project environment.
- Commands for
npx,bunx,yarn, andpnpmare suggested for adding necessary media and layout libraries.
Audit Metadata