remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download official Remotion packages and assets from trusted domains including remotion.media, elevenlabs.io, and mapbox.com.\n- [COMMAND_EXECUTION]: Includes standard CLI examples for package management (e.g., npm install, npx remotion add) and media processing with FFmpeg (e.g., bunx remotion ffmpeg).\n- [CREDENTIALS_UNSAFE]: Properly guides users on securely handling API keys for ElevenLabs and Mapbox through environment variables and .env files, aligning with security best practices.\n- [PROMPT_INJECTION]: The skill identifies surfaces for indirect prompt injection where external data is ingested to generate video content. Ingestion points: API data fetching in calculate-metadata.md, caption JSON fetching in display-captions.md, and Lottie asset fetching in lottie.md. Boundary markers: No specific delimiters or warnings for processed text content are present in the examples. Capability inventory: The skill demonstrates local file system operations and FFmpeg execution in transcribe-captions.md. Sanitization: Content is rendered using standard React components which provide default escaping.
Audit Metadata