remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill describes patterns for fetching external data (JSON, SRT, Lottie files) and incorporating them into the agent's context or video compositions. This creates a surface for indirect prompt injection if the sources are compromised.
  • Ingestion points: rules/calculate-metadata.md (props.dataUrl), rules/compositions.md (API endpoint), rules/display-captions.md (JSON files), rules/import-srt-captions.md (SRT files), and rules/lottie.md (Lottie JSON).
  • Boundary markers: Absent. The fetched data is directly integrated into component state or metadata calculations.
  • Capability inventory: The skill allows for dynamic metadata calculation and prop transformation based on external inputs.
  • Sanitization: Absent. Examples do not demonstrate validation or escaping of external content before use.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing official Remotion packages and tech-standard dependencies like Zod and Mapbox.
  • Evidence: Documented commands for npx remotion add, npm i, and yarn add across multiple rule files (e.g., rules/3d.md, rules/maps.md, rules/parameters.md).
  • [REMOTE_CODE_EXECUTION]: The skill documents the use of @remotion/install-whisper-cpp to download and install the Whisper binary for transcription.
  • Evidence: rules/transcribe-captions.md utilizes the installWhisperCpp function to set up the local transcription environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 02:17 PM
Security Audit — agent-trust-hub — remotion-best-practices