remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements patterns where untrusted data from remote URLs is ingested and used to drive agent behavior and composition properties.
  • Ingestion points: The calculateMetadata function (e.g., in rules/calculate-metadata.md and rules/voiceover.md) fetches data from user-provided URLs (props.dataUrl) or external APIs to determine composition duration, dimensions, and React props. Other points include fetching Lottie animation JSON (e.g., rules/lottie.md) and remote media assets.
  • Boundary markers: The provided examples lack explicit delimiters or instructions to ignore potential commands embedded within the fetched JSON or media metadata.
  • Capability inventory: The skill environment has capabilities for file system access (fs.writeFileSync), network operations (fetch), and command execution via npx remotion (which wraps FFmpeg and other binaries).
  • Sanitization: Fetched data is often directly parsed and spread into component props without rigorous validation or sanitization against a schema.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download and execution of external software and assets.
  • Binary downloads: In rules/transcribe-captions.md, the skill uses the @remotion/install-whisper-cpp package to download the Whisper.cpp executable and machine learning models to the local project directory.
  • Asset references: The skill references external media assets from remotion.media, lottiefiles.com, and a third-party repository on GitHub (github.com/kapishdima/soundcn).
  • [COMMAND_EXECUTION]: Extensive use of CLI tools is documented for media processing and project management.
  • The skill utilizes npx remotion to execute various tasks, including studio for previewing, still for frame rendering, and ffmpeg/ffprobe for video manipulation (as seen in rules/ffmpeg.md and rules/silence-detection.md).
  • In rules/transcribe-captions.md, the downloaded Whisper binary is executed to process audio files.
  • [DYNAMIC_EXECUTION]: The skill uses dynamic data to influence the rendering process.
  • The calculateMetadata feature allows for runtime calculation of video properties based on external API responses or file metadata, which dynamically alters the rendering pipeline.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 09:28 AM