remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Mar 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install various official Remotion packages and reputable third-party libraries like
mapbox-gl,zod, and@turf/turffrom the npm registry.- [COMMAND_EXECUTION]: Guidelines include the use of the Remotion CLI (bunx remotion) for package management, media rendering, and FFmpeg-based video operations.- [REMOTE_CODE_EXECUTION]: The skill recommends running a local Node.js script (generate-voiceover.ts) for AI voiceover generation and usesexecSyncfor audio conversion tasks using FFmpeg.- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it provides patterns for processing untrusted external data that could contain malicious instructions. - Ingestion points:
rules/display-captions.mdandrules/import-srt-captions.mdfetch and parse subtitle files;rules/calculate-metadata.mdfetches data from user-provided URLs. - Boundary markers: No delimiters or explicit instructions to ignore embedded commands are present in the examples.
- Capability inventory: The skill utilizes
fetchfor network requests and executes system commands via FFmpeg. - Sanitization: Provided code examples do not demonstrate validation or escaping of external content before processing.- [PROMPT_INJECTION]: Metadata in
rules/voiceover.mdandrules/maps.mdcontains strict instructions to the agent, such as requiring specific API keys and enforcing camera orientations, though these serve primary skill purposes and do not override safety guidelines.
Audit Metadata