remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions involve executing various CLI tools for project setup, video rendering, and asset processing, including npx remotion, bunx remotion, ffmpeg, ffprobe, and node scripts for generating voiceovers.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates downloading external assets and binaries for specific features, such as Lottie animations from Lottiefiles and the installation of the whisper.cpp binary (version 1.5.5) for audio transcription.
  • [INDIRECT_PROMPT_INJECTION]: The skill identifies surfaces where external, untrusted data is ingested via fetch() to dynamically set video properties or content (e.g., captions and composition props).
  • Ingestion points: Files rules/calculate-metadata.md, rules/compositions.md, rules/display-captions.md, and rules/import-srt-captions.md retrieve external JSON or SRT data.
  • Boundary markers: None identified in the provided patterns; data is integrated directly into the video pipeline.
  • Capability inventory: The skill facilitates powerful capabilities including package installation (npx remotion add), shell execution (ffmpeg), and video rendering (npx remotion render).
  • Sanitization: External data is processed as standard application state (JSON) without specific security sanitization against adversarial instruction embedding.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 04:16 PM