remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several external assets and services necessary for video production, including Lottie animations from LottieFiles, map tiles from MapLibre, and sound effects from a community repository. It also documents the use of ElevenLabs for text-to-speech generation. All downloads target well-known or established service providers.
- [COMMAND_EXECUTION]: The instructions guide users through installing official Remotion packages (e.g.,
@remotion/media,@remotion/three,@remotion/captions) and third-party libraries likezodandmaplibre-glusing standard package managers (npm, yarn, pnpm, bun). It also uses thenpx remotionCLI for studio preview and FFmpeg operations. - [DATA_EXPOSURE]: The skill follows security best practices by recommending the use of environment variables (
ELEVENLABS_API_KEY) for sensitive credentials rather than hardcoding them in scripts. - [INDIRECT_PROMPT_INJECTION]: The skill documents features for ingesting external data (e.g., fetching captions, dynamic metadata, or props from a URL). While this represents a potential attack surface where untrusted data could influence agent behavior, the skill encourages the use of Zod schemas for strict validation of these parameters in
rules/parameters.md.
Audit Metadata