remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions in 'rules/transcribe-captions.md' to install the Whisper.cpp engine using the '@remotion/install-whisper-cpp' package. This involves downloading, compiling, and installing native code on the host machine to facilitate audio transcription.
- [COMMAND_EXECUTION]: The 'rules/ffmpeg.md' file recommends the use of shell commands via 'bunx remotion ffmpeg' and 'bunx remotion ffprobe' to perform video processing tasks such as re-encoding, trimming, and metadata discovery.
- [EXTERNAL_DOWNLOADS]: The instructions involve downloading resources from various external domains, including Lottie animations from 'lottiefiles.com' ('rules/lottie.md'), Google Fonts ('rules/fonts.md'), and media assets from 'remotion.media' and other developer-specified URLs.
- [PROMPT_INJECTION]: The skill utilizes the 'calculateMetadata' lifecycle method in 'rules/calculate-metadata.md' and 'rules/compositions.md', which creates a surface for indirect prompt injection.
- Ingestion points: The 'calculateMetadata' function is instructed to fetch and process JSON data from arbitrary external URLs provided via component props ('props.dataUrl').
- Boundary markers: There are no explicit instructions to use delimiters or ignore instructions that might be embedded within the processed data.
- Capability inventory: The skill has access to shell command execution (FFmpeg), native binary installation (Whisper.cpp), and network operations.
- Sanitization: No filtering or validation logic is defined for the content returned by the remote data fetches.
Audit Metadata