remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on May 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents standard CLI commands for Remotion project management, including initialization (npx create-video), plugin management (npx remotion add), and asset rendering (npx remotion render). These are expected operations for the stated purpose.
  • [EXTERNAL_DOWNLOADS]: The skill references official Remotion documentation, packages, and assets from the remotion.dev and remotion.media domains. It also integrates with well-known third-party services such as Mapbox, ElevenLabs, and LottieFiles for specific video features.
  • [CREDENTIALS_UNSAFE]: The skill provides best-practice guidance for managing sensitive API keys (e.g., ElevenLabs, Mapbox) by recommending the use of environment variables and .env files, which is a standard security measure.
  • [DYNAMIC_EXECUTION]: The skill includes boilerplate code for Node.js scripts that handle file system operations like writing JSON captions or audio files. These are presented as developer-controlled tasks necessary for the video generation workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for fetching data from external APIs and processing user-provided files (SRT, JSON). This identifies an attack surface for the final application, but the skill itself does not contain malicious injection patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
May 7, 2026, 05:28 PM