remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Aug 16, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill describes patterns that ingest untrusted data from external sources, presenting a surface for indirect prompt injection where malicious external content could influence agent-driven logic or video content.
  • Ingestion points:
  • rules/calculate-metadata.md: Suggests fetching data from a dynamic props.dataUrl to populate composition properties.
  • rules/compositions.md: Demonstrates fetching video data from an external API.
  • rules/import-srt-captions.md: Provides a pattern for fetching and parsing .srt files from local or remote URLs.
  • Boundary markers: None identified in the provided patterns to distinguish between data and instructions.
  • Capability inventory: The skill defines the rendering environment for videos, where ingested data determines props, dimensions, and text content.
  • Sanitization: No validation or sanitization routines for the fetched data are included in the examples.
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing various official extensions from the Remotion ecosystem and fetching assets or documentation from remote domains.
  • Installation commands are provided for @remotion/three, @remotion/media, @remotion/captions, @remotion/google-fonts, @remotion/fonts, @remotion/gif, @remotion/layout-utils, and @remotion/transitions.
  • The skill also references remote assets from assets4.lottiefiles.com and documentation from www.remotion.dev.
  • [COMMAND_EXECUTION]: The skill provides standard shell commands for package management in a Remotion project environment.
  • Commands for npx, bunx, yarn, and pnpm are suggested for adding necessary media and layout libraries.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 16, 2026, 10:54 PM