remotion-best-practices
Warn
Audited by Snyk on Mar 6, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill contains multiple runtime examples that fetch and ingest arbitrary external URLs (e.g., rules/calculate-metadata.md shows fetch(props.dataUrl) to load JSON and set composition props, rules/assets.md and rules/audio.md show remote asset URLs like "https://remotion.media/..." and rules/extract-frames.md uses UrlSource(src) to load videos), meaning untrusted third-party content is read and used to determine metadata, props, and processing decisions.
Audit Metadata