remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of numerous official Remotion packages (e.g., @remotion/media, @remotion/captions) and well-known third-party libraries such as zod, mapbox-gl, and mediabunny. It also references assets from official domains and reputable services like Mapbox and ElevenLabs.
- [COMMAND_EXECUTION]: The instructions guide the agent to execute various CLI commands for project scaffolding (npx create-video), package management (remotion add), and video processing (npx remotion render, ffmpeg).
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing external, potentially untrusted data:
- Ingestion points: Metadata fetching in SKILL.md and rules/calculate-metadata.md, caption fetching in rules/display-captions.md, and subtitle parsing in rules/import-srt-captions.md.
- Boundary markers: None identified to delimit external content from instructions.
- Capability inventory: The skill uses network operations (fetch), shell commands (npx, ffmpeg), and local file operations (via code examples), which could be influenced if external data contains instructions the agent obeys.
- Sanitization: No explicit sanitization or validation of the fetched data content is shown in the provided examples.
Audit Metadata