remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Apr 25, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to download and use various official Remotion packages and third-party libraries (e.g., Lottie, Mapbox, Turf.js). It also references media assets from remotion.media, which is the official domain for the framework. These are standard dependencies for the described functionality.
  • [COMMAND_EXECUTION]: The skill provides numerous npx commands for project management and adding dependencies. These commands are typical for the Remotion ecosystem (e.g., npx remotion studio, npx remotion add).
  • [INDIRECT_PROMPT_INJECTION]: Some components utilize fetch to ingest data from external sources (e.g., in calculate-metadata.md and voiceover.md) to dynamically determine video properties or content.
  • Ingestion points: Data entering via fetch calls in calculateMetadata and external TTS scripts.
  • Boundary markers: Absent (Standard for data-driven templates).
  • Capability inventory: Shell command execution via npx, file system access for public assets, and network requests.
  • Sanitization: The skill relies on the developer to sanitize inputs from external APIs.
  • [CREDENTIALS_UNSAFE]: The skill demonstrates best practices by instructing users to store sensitive credentials (like the Mapbox access token or ElevenLabs API key) in .env files or environment variables rather than hardcoding them.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 25, 2026, 10:54 PM