remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (SAFE): The skill recommends installing various official @remotion packages (e.g., @remotion/three, @remotion/media, @remotion/captions) using npx. These are verified dependencies for the Remotion ecosystem.
- [COMMAND_EXECUTION] (SAFE): Documentation in rules/transcribe-captions.md describes a workflow for installing and running transcription tools like whisper.cpp. This is a standard technical requirement for video automation tasks.
- [PROMPT_INJECTION] (LOW): An indirect prompt injection surface is present in rules/calculate-metadata.md where data is fetched from a user-supplied URL. 1. Ingestion points: fetch(props.dataUrl) in rules/calculate-metadata.md. 2. Boundary markers: Absent. 3. Capability inventory: Data determines composition props, duration, and dimensions. 4. Sanitization: Absent. This surface is characteristic of data-driven video tools.
Audit Metadata