remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents how to fetch and use assets from several reputable external services. Specifically, it includes instructions for loading fonts from Google Fonts, map data from Mapbox, animation files from LottieFiles, and AI voiceovers from ElevenLabs. These integrations are common in the Remotion ecosystem and target established, well-known technology providers.\n- [COMMAND_EXECUTION]: Multiple files (e.g., 'rules/3d.md', 'rules/audio.md', 'rules/maps.md') provide shell commands for installing framework-related packages using standard package managers like npm, yarn, pnpm, and bun. Additionally, 'rules/ffmpeg.md' describes the use of FFmpeg and FFprobe via the 'remotion' CLI, and 'rules/transcribe-captions.md' provides a script for installing 'whisper.cpp' via the '@remotion/install-whisper-cpp' package to handle local audio transcription.\n- [PROMPT_INJECTION]: The skill identifies surfaces for indirect prompt injection, particularly in 'rules/calculate-metadata.md' and 'rules/voiceover.md', where data is fetched from external URLs or text is processed for TTS. These are documented as standard features for creating dynamic, data-driven videos. Ingestion points: 'calculateMetadata' fetches data from 'props.dataUrl'; 'voiceover' generation processes text inputs. Boundary markers: Not present in the code snippets provided. Capability inventory: Access to network operations ('fetch'), file system operations ('writeFileSync'), and media tools ('ffmpeg'). Sanitization: Examples demonstrate standard JSON parsing and text processing without explicit validation of external content.
Audit Metadata