remotion-video-toolkit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly fetches and ingests arbitrary remote URLs as part of runtime flows (e.g., calculate-metadata.md shows calculateMetadata fetching props.dataUrl to set props, and rules like assets.md, lottie.md, and import-srt-captions.md allow loading remote media/JSON/SRT), meaning untrusted third‑party content is read and can directly alter composition props and rendering behavior.