remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous instructions for installing official Remotion packages using standard package managers (npm, bun, yarn, pnpm) via the
remotion addutility. - [COMMAND_EXECUTION]: Instructs the use of
ffmpegandffprobefor media processing tasks such as video trimming and format analysis, typically executed viabunx remotion ffmpeg/ffprobe. - [EXTERNAL_DOWNLOADS]: Fetches assets and configuration data from trusted and well-known sources, including
remotion.media,lottiefiles.com,google-fonts, andmapbox.com. - [REMOTE_CODE_EXECUTION]: Includes patterns for the automated installation of the Whisper.cpp transcription engine and its associated models using the
@remotion/install-whisper-cpputility. - [EXTERNAL_DOWNLOADS]: Uses
fetchto retrieve external data for dynamic composition metadata and Lottie animations, which is a standard pattern for data-driven video generation. - [SAFE]: Recommends secure credential management practices by instructing users to store API keys for ElevenLabs and Mapbox in
.envfiles rather than hardcoding them in scripts. - [PROMPT_INJECTION]: The skill defines surfaces for processing untrusted external data which could be a vector for indirect prompt injection.
- Ingestion points: External JSON data fetched in
calculateMetadata(calculate-metadata.md), Lottie animation files (lottie.md), and caption files (display-captions.md). - Boundary markers: Absent.
- Capability inventory: Subprocess execution via
remotion addandffmpeg, network requests viafetch, and file system operations viafs.writeFileSyncintranscribe-captions.md. - Sanitization: Absent.
Audit Metadata