remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements patterns where untrusted data from remote URLs is ingested and used to drive agent behavior and composition properties.
- Ingestion points: The
calculateMetadatafunction (e.g., inrules/calculate-metadata.mdandrules/voiceover.md) fetches data from user-provided URLs (props.dataUrl) or external APIs to determine composition duration, dimensions, and React props. Other points include fetching Lottie animation JSON (e.g.,rules/lottie.md) and remote media assets. - Boundary markers: The provided examples lack explicit delimiters or instructions to ignore potential commands embedded within the fetched JSON or media metadata.
- Capability inventory: The skill environment has capabilities for file system access (
fs.writeFileSync), network operations (fetch), and command execution vianpx remotion(which wraps FFmpeg and other binaries). - Sanitization: Fetched data is often directly parsed and spread into component props without rigorous validation or sanitization against a schema.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download and execution of external software and assets.
- Binary downloads: In
rules/transcribe-captions.md, the skill uses the@remotion/install-whisper-cpppackage to download the Whisper.cpp executable and machine learning models to the local project directory. - Asset references: The skill references external media assets from
remotion.media,lottiefiles.com, and a third-party repository on GitHub (github.com/kapishdima/soundcn). - [COMMAND_EXECUTION]: Extensive use of CLI tools is documented for media processing and project management.
- The skill utilizes
npx remotionto execute various tasks, includingstudiofor previewing,stillfor frame rendering, andffmpeg/ffprobefor video manipulation (as seen inrules/ffmpeg.mdandrules/silence-detection.md). - In
rules/transcribe-captions.md, the downloaded Whisper binary is executed to process audio files. - [DYNAMIC_EXECUTION]: The skill uses dynamic data to influence the rendering process.
- The
calculateMetadatafeature allows for runtime calculation of video properties based on external API responses or file metadata, which dynamically alters the rendering pipeline.
Audit Metadata