remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides terminal commands for project scaffolding via npx create-video, studio previewing via npx remotion studio, and static frame rendering with npx remotion still.
  • [EXTERNAL_DOWNLOADS]: It facilitates the installation of various Remotion plugins and external libraries such as mediabunny, maplibre-gl, and zod. The transcription module specifically handles the download of the Whisper.cpp binary and pre-trained AI models.
  • [DYNAMIC_EXECUTION]: Documentation describes creating Node.js scripts for AI voiceover and transcription that manage file writing and remote API calls. The html-in-canvas rule utilizes browser APIs for frame-by-frame rendering logic in a canvas context.
  • [INDIRECT_PROMPT_INJECTION]: The skill contains patterns for ingesting external data sources that could influence composition behavior.
  • Ingestion points: calculateMetadata fetches from remote APIs; Lottie components load animation JSON; parseSrt processes subtitle files.
  • Boundary markers: None specified in the instructional text.
  • Capability inventory: Filesystem writing via fs.writeFileSync, network operations via fetch, and command execution through the Remotion CLI and Whisper binaries.
  • Sanitization: Not explicitly detailed in the provided coding examples.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 10:52 AM