remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions involve executing various CLI tools for project setup, video rendering, and asset processing, including
npx remotion,bunx remotion,ffmpeg,ffprobe, andnodescripts for generating voiceovers. - [EXTERNAL_DOWNLOADS]: The skill facilitates downloading external assets and binaries for specific features, such as Lottie animations from Lottiefiles and the installation of the
whisper.cppbinary (version 1.5.5) for audio transcription. - [INDIRECT_PROMPT_INJECTION]: The skill identifies surfaces where external, untrusted data is ingested via
fetch()to dynamically set video properties or content (e.g., captions and composition props). - Ingestion points: Files
rules/calculate-metadata.md,rules/compositions.md,rules/display-captions.md, andrules/import-srt-captions.mdretrieve external JSON or SRT data. - Boundary markers: None identified in the provided patterns; data is integrated directly into the video pipeline.
- Capability inventory: The skill facilitates powerful capabilities including package installation (
npx remotion add), shell execution (ffmpeg), and video rendering (npx remotion render). - Sanitization: External data is processed as standard application state (JSON) without specific security sanitization against adversarial instruction embedding.
Audit Metadata