remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Mar 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to install various official Remotion packages and reputable third-party libraries like mapbox-gl, zod, and @turf/turf from the npm registry.- [COMMAND_EXECUTION]: Guidelines include the use of the Remotion CLI (bunx remotion) for package management, media rendering, and FFmpeg-based video operations.- [REMOTE_CODE_EXECUTION]: The skill recommends running a local Node.js script (generate-voiceover.ts) for AI voiceover generation and uses execSync for audio conversion tasks using FFmpeg.- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it provides patterns for processing untrusted external data that could contain malicious instructions.
  • Ingestion points: rules/display-captions.md and rules/import-srt-captions.md fetch and parse subtitle files; rules/calculate-metadata.md fetches data from user-provided URLs.
  • Boundary markers: No delimiters or explicit instructions to ignore embedded commands are present in the examples.
  • Capability inventory: The skill utilizes fetch for network requests and executes system commands via FFmpeg.
  • Sanitization: Provided code examples do not demonstrate validation or escaping of external content before processing.- [PROMPT_INJECTION]: Metadata in rules/voiceover.md and rules/maps.md contains strict instructions to the agent, such as requiring specific API keys and enforcing camera orientations, though these serve primary skill purposes and do not override safety guidelines.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 22, 2026, 10:18 PM