remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Apr 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous instructions for installing official Remotion packages using standard package managers (npm, bun, yarn, pnpm) via the remotion add utility.
  • [COMMAND_EXECUTION]: Instructs the use of ffmpeg and ffprobe for media processing tasks such as video trimming and format analysis, typically executed via bunx remotion ffmpeg/ffprobe.
  • [EXTERNAL_DOWNLOADS]: Fetches assets and configuration data from trusted and well-known sources, including remotion.media, lottiefiles.com, google-fonts, and mapbox.com.
  • [REMOTE_CODE_EXECUTION]: Includes patterns for the automated installation of the Whisper.cpp transcription engine and its associated models using the @remotion/install-whisper-cpp utility.
  • [EXTERNAL_DOWNLOADS]: Uses fetch to retrieve external data for dynamic composition metadata and Lottie animations, which is a standard pattern for data-driven video generation.
  • [SAFE]: Recommends secure credential management practices by instructing users to store API keys for ElevenLabs and Mapbox in .env files rather than hardcoding them in scripts.
  • [PROMPT_INJECTION]: The skill defines surfaces for processing untrusted external data which could be a vector for indirect prompt injection.
  • Ingestion points: External JSON data fetched in calculateMetadata (calculate-metadata.md), Lottie animation files (lottie.md), and caption files (display-captions.md).
  • Boundary markers: Absent.
  • Capability inventory: Subprocess execution via remotion add and ffmpeg, network requests via fetch, and file system operations via fs.writeFileSync in transcribe-captions.md.
  • Sanitization: Absent.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 18, 2026, 02:18 AM