remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill describes patterns for fetching external data (JSON, SRT, Lottie files) and incorporating them into the agent's context or video compositions. This creates a surface for indirect prompt injection if the sources are compromised.
- Ingestion points:
rules/calculate-metadata.md(props.dataUrl),rules/compositions.md(API endpoint),rules/display-captions.md(JSON files),rules/import-srt-captions.md(SRT files), andrules/lottie.md(Lottie JSON). - Boundary markers: Absent. The fetched data is directly integrated into component state or metadata calculations.
- Capability inventory: The skill allows for dynamic metadata calculation and prop transformation based on external inputs.
- Sanitization: Absent. Examples do not demonstrate validation or escaping of external content before use.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing official Remotion packages and tech-standard dependencies like Zod and Mapbox.
- Evidence: Documented commands for
npx remotion add,npm i, andyarn addacross multiple rule files (e.g.,rules/3d.md,rules/maps.md,rules/parameters.md). - [REMOTE_CODE_EXECUTION]: The skill documents the use of
@remotion/install-whisper-cppto download and install the Whisper binary for transcription. - Evidence:
rules/transcribe-captions.mdutilizes theinstallWhisperCppfunction to set up the local transcription environment.
Audit Metadata