remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several external resources necessary for video production, including Google Fonts, Lottie animation assets (assets4.lottiefiles.com), and geographic data for maps (PublicaMundi/MappingAPI on GitHub). These downloads originate from well-known services or established open-source repositories relevant to the skill's primary function.
- [REMOTE_CODE_EXECUTION]: Instructions in
rules/transcribe-captions.mddetail the use of@remotion/install-whisper-cppto download and install Whisper.cpp binaries. This is a standard and expected workflow for audio transcription within the Remotion ecosystem and is provided as a legitimate tool for the user. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for ingesting untrusted external data, such as JSON captions, Lottie files, and GeoJSON boundaries. The ingestion points are located in
rules/display-captions.md,rules/lottie.md, andrules/maps.md. While no explicit boundary markers are present in the examples, the skill provides a dedicated module (rules/parameters.md) for sanitizing and validating input data using Zod schemas, which is a recommended security best practice. - [COMMAND_EXECUTION]: Documentation includes educational examples of executing shell commands, such as using
ffmpegviaexecSyncfor audio conversion. These snippets are intended for user implementation in their own scripts and are not executed autonomously by the skill.
Audit Metadata