remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for fetching and processing external data via the calculateMetadata and fetch functions (found in rules/calculate-metadata.md, rules/compositions.md, and rules/lottie.md). This creates a surface where the agent might ingest untrusted content that could influence its behavior if not properly handled.
  • Ingestion points: Usage of the CalculateMetadataFunction and fetch API in rules/calculate-metadata.md, rules/compositions.md, and rules/lottie.md to retrieve remote JSON or asset data.
  • Boundary markers: None present in the provided code examples to distinguish between data and instructions.
  • Capability inventory: The skill utilizes fetch for network operations and dynamic property transformation within the React/Remotion environment.
  • Sanitization: The provided snippets do not demonstrate validation or sanitization of the fetched data before use.
  • [COMMAND_EXECUTION]: Multiple files (e.g., rules/3d.md, rules/audio.md, rules/fonts.md) provide terminal commands for the user or agent to run for dependency management using the Remotion CLI (e.g., npx remotion add @remotion/media).
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download and usage of official framework packages from the @remotion scope and external assets from well-known services like Lottiefiles and Google Fonts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 03:42 PM