remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill documents standard CLI commands for Remotion project management, including initialization (
npx create-video), plugin management (npx remotion add), and asset rendering (npx remotion render). These are expected operations for the stated purpose. - [EXTERNAL_DOWNLOADS]: The skill references official Remotion documentation, packages, and assets from the
remotion.devandremotion.mediadomains. It also integrates with well-known third-party services such as Mapbox, ElevenLabs, and LottieFiles for specific video features. - [CREDENTIALS_UNSAFE]: The skill provides best-practice guidance for managing sensitive API keys (e.g., ElevenLabs, Mapbox) by recommending the use of environment variables and
.envfiles, which is a standard security measure. - [DYNAMIC_EXECUTION]: The skill includes boilerplate code for Node.js scripts that handle file system operations like writing JSON captions or audio files. These are presented as developer-controlled tasks necessary for the video generation workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for fetching data from external APIs and processing user-provided files (SRT, JSON). This identifies an attack surface for the final application, but the skill itself does not contain malicious injection patterns.
Audit Metadata