remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references several external resources necessary for video production, including Google Fonts, Lottie animation assets (assets4.lottiefiles.com), and geographic data for maps (PublicaMundi/MappingAPI on GitHub). These downloads originate from well-known services or established open-source repositories relevant to the skill's primary function.
  • [REMOTE_CODE_EXECUTION]: Instructions in rules/transcribe-captions.md detail the use of @remotion/install-whisper-cpp to download and install Whisper.cpp binaries. This is a standard and expected workflow for audio transcription within the Remotion ecosystem and is provided as a legitimate tool for the user.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for ingesting untrusted external data, such as JSON captions, Lottie files, and GeoJSON boundaries. The ingestion points are located in rules/display-captions.md, rules/lottie.md, and rules/maps.md. While no explicit boundary markers are present in the examples, the skill provides a dedicated module (rules/parameters.md) for sanitizing and validating input data using Zod schemas, which is a recommended security best practice.
  • [COMMAND_EXECUTION]: Documentation includes educational examples of executing shell commands, such as using ffmpeg via execSync for audio conversion. These snippets are intended for user implementation in their own scripts and are not executed autonomously by the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 05:09 PM