remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing various framework-specific packages from the @remotion ecosystem and external dependencies like mapbox-gl and zod. It also describes how to download and install Whisper.cpp binaries and models using the @remotion/install-whisper-cpp utility.\n- [COMMAND_EXECUTION]: Instructions guide the agent to perform package management operations such as 'npx remotion add' and 'npm install'. Additionally, it provides code examples that may execute shell commands for media processing, such as using ffmpeg via child_process.\n- [PROMPT_INJECTION]: The skill demonstrates patterns for fetching data from external or user-provided URLs within the video generation process (e.g., in calculateMetadata and Lottie loading). These ingestion points represent an indirect prompt injection surface where untrusted data could influence the agent's behavior.\n
- Ingestion points: rules/calculate-metadata.md (props.dataUrl), rules/compositions.md (external API), rules/lottie.md (external JSON), rules/display-captions.md (external JSON).\n
- Boundary markers: None detected in the provided code examples.\n
- Capability inventory: The skill allows for network operations (fetch), file writes (transcription output), and subprocess execution (via package managers and media tools).\n
- Sanitization: The provided examples do not include sanitization or validation of the fetched external data before it is incorporated into the composition properties.
Audit Metadata