remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to download and use various official Remotion packages and third-party libraries (e.g., Lottie, Mapbox, Turf.js). It also references media assets from
remotion.media, which is the official domain for the framework. These are standard dependencies for the described functionality. - [COMMAND_EXECUTION]: The skill provides numerous
npxcommands for project management and adding dependencies. These commands are typical for the Remotion ecosystem (e.g.,npx remotion studio,npx remotion add). - [INDIRECT_PROMPT_INJECTION]: Some components utilize
fetchto ingest data from external sources (e.g., incalculate-metadata.mdandvoiceover.md) to dynamically determine video properties or content. - Ingestion points: Data entering via
fetchcalls incalculateMetadataand external TTS scripts. - Boundary markers: Absent (Standard for data-driven templates).
- Capability inventory: Shell command execution via
npx, file system access for public assets, and network requests. - Sanitization: The skill relies on the developer to sanitize inputs from external APIs.
- [CREDENTIALS_UNSAFE]: The skill demonstrates best practices by instructing users to store sensitive credentials (like the Mapbox access token or ElevenLabs API key) in
.envfiles or environment variables rather than hardcoding them.
Audit Metadata