remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of standard Remotion framework packages (e.g.,
@remotion/media,@remotion/three,@remotion/transitions) from the official NPM registry. - [COMMAND_EXECUTION]: Provides instructions for using Remotion CLI tools and FFmpeg for video processing tasks like trimming and silence detection (e.g.,
npx remotion ffmpeg). - [REMOTE_CODE_EXECUTION]: Includes a script in
rules/transcribe-captions.mdthat uses@remotion/install-whisper-cppto download and install the Whisper.cpp binary and models for audio transcription. - [DATA_EXPOSURE]: The skill demonstrates fetching data from external URLs (e.g., ElevenLabs API for TTS, LottieFiles for animations, and user-provided data URLs in
calculateMetadata) which are standard features for dynamic video generation. - [INDIRECT_PROMPT_INJECTION]: The skill contains data ingestion points where untrusted external content (SRT subtitles, Lottie JSON, and audio files) is processed to drive video rendering. While this creates an attack surface for indirect prompt injection, it is a primary function of the video framework and handled through standard API calls.
Audit Metadata