remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a high-quality documentation and pattern library for the Remotion video framework. All instructions align with official framework recommendations.
- [COMMAND_EXECUTION]: The skill provides examples for using project-related CLI tools such as
npx remotion add,bunx remotion ffmpeg, andbunx remotion ffprobe. These are standard practices for media processing and package management within this specific technical domain. - [EXTERNAL_DOWNLOADS]: The skill references several external resources and services:
- Official Remotion assets (
remotion.media). - Well-known services for video components such as Mapbox, ElevenLabs, and LottieFiles.
- Publicly available sound effect assets on GitHub. None of these references involve the execution of untrusted remote code; they are limited to static assets (audio, images, JSON) or authenticated API interactions.
- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for ingesting external data to drive video content (e.g., fetching composition props from an API, parsing SRT files, or loading Lottie animation data). While this creates an attack surface, the risk is inherent to data-driven video generation and is categorized as low:
- Ingestion points: Data is fetched via
fetch()incalculateMetadata(rules/calculate-metadata.md) and asset loaders (rules/lottie.md, rules/display-captions.md). - Boundary markers: None explicitly mentioned in the code samples.
- Capability inventory: The skill uses network operations (
fetch) and media rendering capabilities. One utility script example mentions file system writes for caching audio files. - Sanitization: No specific sanitization logic is shown in the provided examples, as the focus is on framework implementation rather than input validation.
Audit Metadata