remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for ingesting untrusted data from external sources which is then used to drive agent behavior or video generation.
- Ingestion points: External URLs in
props.dataUrl(calculate-metadata.md),props.videoIdfor API lookups (compositions.md), and local subtitle/caption files (display-captions.md,import-srt-captions.md). - Boundary markers: None. The skill does not instruct the agent to use delimiters or warnings when processing data from these sources.
- Capability inventory: Execution of FFmpeg commands (
ffmpeg.md), use of Whisper.cpp for transcription (transcribe-captions.md), and network operations via the ElevenLabs API (voiceover.md). - Sanitization: None. Data is parsed as JSON or text but not sanitized for potential embedded instructions.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the acquisition of external assets and software tools.
- Downloads and installs the Whisper.cpp engine and specific models for speech-to-text functionality (
transcribe-captions.md). - Fetches Lottie animation assets from
lottiefiles.com(lottie.md). - Fetches AI-generated audio from ElevenLabs' infrastructure (
voiceover.md). - References external sound effects from a public GitHub repository (
sfx.md). - [COMMAND_EXECUTION]: The skill leverages local command-line tools to perform its tasks.
- Uses
ffmpegandffprobefor video manipulation and metadata extraction (ffmpeg.md). - Executes
remotionCLI commands for package management and rendering processes.
Audit Metadata