remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for installing necessary Remotion dependencies using standard package managers (npm, yarn, pnpm, bun) via the
remotion addCLI command. - [EXTERNAL_DOWNLOADS]: Instructions in
rules/tailwind.mdsuggest using a web fetch tool to retrieve documentation from the official Remotion domain (remotion.dev). Additionally, several examples demonstrate fetching media assets or metadata from the framework's official media host and other common service providers. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by demonstrating how to fetch and process external data within video compositions.
- Ingestion points: Rule files such as
calculate-metadata.md,compositions.md, andlottie.mdinclude examples of fetching data from remote URLs viafetch()calls. - Boundary markers: The provided templates do not explicitly implement boundary markers or instructions to disregard potential commands embedded in the fetched data.
- Capability inventory: The skill is limited to providing React-based UI and video logic; it does not authorize the agent to perform privileged system operations or sensitive network requests outside the scope of media processing.
- Sanitization: Code examples prioritize functionality and do not show specific sanitization logic for incoming data payloads.
Audit Metadata