remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides terminal commands for project scaffolding via
npx create-video, studio previewing vianpx remotion studio, and static frame rendering withnpx remotion still. - [EXTERNAL_DOWNLOADS]: It facilitates the installation of various Remotion plugins and external libraries such as
mediabunny,maplibre-gl, andzod. The transcription module specifically handles the download of the Whisper.cpp binary and pre-trained AI models. - [DYNAMIC_EXECUTION]: Documentation describes creating Node.js scripts for AI voiceover and transcription that manage file writing and remote API calls. The
html-in-canvasrule utilizes browser APIs for frame-by-frame rendering logic in a canvas context. - [INDIRECT_PROMPT_INJECTION]: The skill contains patterns for ingesting external data sources that could influence composition behavior.
- Ingestion points:
calculateMetadatafetches from remote APIs;Lottiecomponents load animation JSON;parseSrtprocesses subtitle files. - Boundary markers: None specified in the instructional text.
- Capability inventory: Filesystem writing via
fs.writeFileSync, network operations viafetch, and command execution through the Remotion CLI and Whisper binaries. - Sanitization: Not explicitly detailed in the provided coding examples.
Audit Metadata