remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a collection of documentation and code templates for the Remotion video framework and does not contain any malicious instructions or obfuscated content.
- [COMMAND_EXECUTION]: The skill documents the use of command-line tools such as
ffmpeg,ffprobe, and the Remotion CLI for video processing and rendering tasks (Evidence: rules/ffmpeg.md, rules/transparent-videos.md). - [EXTERNAL_DOWNLOADS]: The skill references official Remotion npm packages and assets from well-known providers like Google Fonts, Mapbox, and ElevenLabs. It also suggests a community repository for sound effects (Evidence: rules/3d.md, rules/fonts.md, rules/sfx.md).
- [REMOTE_CODE_EXECUTION]: Documentation is provided for using the
@remotion/install-whisper-cpplibrary to download and install the Whisper.cpp binary locally for transcription purposes (Evidence: rules/transcribe-captions.md). - [PROMPT_INJECTION]: The skill includes patterns for fetching and processing external data (e.g., Lottie files, SRT subtitles, and remote JSON data) which represents a surface for indirect prompt injection if the ingested content is untrusted. * Ingestion points: rules/calculate-metadata.md (fetch from props.dataUrl), rules/import-srt-captions.md (fetch from subtitles.srt), rules/lottie.md (fetch from lottiefiles.com). * Boundary markers: None documented in the code snippets. * Capability inventory: Includes shell command execution (ffmpeg), binary downloads (whisper.cpp), and file system writes. * Sanitization: The provided examples do not demonstrate explicit sanitization of remote data content. (Evidence: rules/calculate-metadata.md, rules/import-srt-captions.md, rules/lottie.md)
Audit Metadata