remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several official packages from the Remotion ecosystem. These downloads are directed to the standard npm registry and target well-known libraries for video production.\n
- Evidence: Recommendations to install
@remotion/three,@remotion/media,@remotion/captions,@remotion/google-fonts,@remotion/fonts,@remotion/layout-utils,@remotion/gif,@remotion/lottie, and@remotion/transitions.\n- [COMMAND_EXECUTION]: Instructions include using theremotion addcommand via standard package runners (npx, bunx, pnpm, yarn) to install official framework extensions.\n- [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for ingesting external data, such as JSON metadata and SRT subtitles, which represent a potential attack surface for indirect injection if the source data is compromised.\n - Ingestion points:
rules/calculate-metadata.md(props.dataUrl),rules/import-srt-captions.md(subtitles.srt),rules/lottie.md(external Lottie JSON).\n - Boundary markers: The examples do not include explicit delimiter-based boundary markers.\n
- Capability inventory: The skill uses
fetchand parsing logic to incorporate external data into video compositions.\n - Sanitization: No specific sanitization or validation logic is presented in the simplified code examples.
Audit Metadata