remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes official Remotion ecosystem packages and provides instructions for downloading external tools such as Whisper.cpp for speech-to-text processing.
- [COMMAND_EXECUTION]: The skill documentation includes scripts that use FFmpeg and Node.js for media transcoding, transcription, and file system operations.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data including SRT subtitle files, remote Lottie animation JSON, and media metadata. 1. Ingestion points: SRT parsing in rules/import-srt-captions.md, Lottie fetch in rules/lottie.md. 2. Boundary markers: Absent. 3. Capability inventory: fs.writeFileSync in rules/transcribe-captions.md and FFmpeg execution in rules/ffmpeg.md. 4. Sanitization: Absent.
- [SAFE]: No malicious intent was identified. The skill correctly instructs users to store sensitive keys for services like ElevenLabs and Mapbox in environment variables rather than hardcoding them.
Audit Metadata