remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [SAFE]: The skill consists of documentation and code examples that follow the standard best practices of the Remotion video creation framework. All recommendations align with the primary purpose of the skill and utilize official tools.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing various packages from the Remotion ecosystem (e.g.,
@remotion/three,@remotion/media,@remotion/captions) and well-known libraries such asmapbox-gl,zod, andturfusing standard package managers (npm, yarn, pnpm, bun). - [REMOTE_CODE_EXECUTION]: Instructions in
rules/transcribe-captions.mddescribe using the@remotion/install-whisper-cpputility to download the Whisper.cpp binary and pre-trained models. This is an established procedure for audio transcription within the Remotion ecosystem. - [INDIRECT_PROMPT_INJECTION]: Several rule files (e.g.,
calculate-metadata.md,display-captions.md,import-srt-captions.md) describe patterns for fetching and processing data from external URLs or local files (JSON, SRT) to drive composition metadata or visual content. - Ingestion points: External data is ingested via
fetch(props.dataUrl)incalculateMetadataand through the retrieval of JSON or SRT files for captions. - Boundary markers: The provided examples do not explicitly define boundary markers or instructions to ignore embedded commands for the ingested data.
- Capability inventory: The skill demonstrates file system operations (
fs.writeFileSync) and describes package installation capabilities. Example comments also mention the use offfmpegvia subprocess execution. - Sanitization: The examples do not show explicit sanitization or validation of the external data before it is incorporated into component props or rendered content.
Audit Metadata