remotion-best-practices

SUSPICIOUS: The core Remotion package-upgrade behavior is coherent and uses normal npm/Remotion tooling, but the fallback path also updates multiple AI skills through an unrelated third-party `skills` CLI with `--yes`. That transitive skill installation is broader than a package-upgrade skill needs and materially increases trust scope, though there is no clear credential theft or malicious exfiltration evidence.