remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a documentation guide for the Remotion framework. All referenced tools, packages, and URLs point to the official framework ecosystem or established services such as Google Fonts and LottieFiles.
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external data sources, including JSON from APIs, subtitle files, and remote media URLs. While this creates an ingestion surface for untrusted data, the risk is minimal as the data is used solely for video rendering within a restricted React environment.
- Ingestion points: rules/calculate-metadata.md (API JSON fetching), rules/import-srt-captions.md (SRT file parsing), rules/assets.md (Remote asset loading).
- Boundary markers: Absent in code templates.
- Capability inventory: Limited to video metadata calculation and React component rendering.
- Sanitization: Not explicitly required for the provided rendering examples.
Audit Metadata