remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for installing necessary Remotion dependencies using standard package managers (npm, yarn, pnpm, bun) via the remotion add CLI command.
  • [EXTERNAL_DOWNLOADS]: Instructions in rules/tailwind.md suggest using a web fetch tool to retrieve documentation from the official Remotion domain (remotion.dev). Additionally, several examples demonstrate fetching media assets or metadata from the framework's official media host and other common service providers.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by demonstrating how to fetch and process external data within video compositions.
  • Ingestion points: Rule files such as calculate-metadata.md, compositions.md, and lottie.md include examples of fetching data from remote URLs via fetch() calls.
  • Boundary markers: The provided templates do not explicitly implement boundary markers or instructions to disregard potential commands embedded in the fetched data.
  • Capability inventory: The skill is limited to providing React-based UI and video logic; it does not authorize the agent to perform privileged system operations or sensitive network requests outside the scope of media processing.
  • Sanitization: Code examples prioritize functionality and do not show specific sanitization logic for incoming data payloads.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 03:00 PM