remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Feb 22, 2026
Risk Level: SAFE
Full Analysis
- COMMAND_EXECUTION (SAFE): The skill provides instructions for using CLI tools like
ffmpegandffprobethrough theremotionCLI. These are standard operations for video manipulation and metadata extraction. - EXTERNAL_DOWNLOADS (SAFE): Several files contain instructions to install packages from the
@remotion/*ecosystem using standard package managers (npm, bun, yarn, pnpm). These are legitimate dependencies for the framework's functionality. - REMOTE_CODE_EXECUTION (SAFE): The
transcribe-captions.mdrule includes instructions to download and installwhisper.cppvia a dedicated utility package. This is a documented and functional requirement for the audio transcription feature. - CREDENTIALS_UNSAFE (SAFE): The
voiceover.mdfile references anELEVENLABS_API_KEYbut correctly instructs the user to provide it via a.envfile and uses a placeholder in example code. No secrets are leaked or hardcoded. - DATA_EXFILTRATION (SAFE): Network requests observed in the examples (fetching Lottie animations, calling ElevenLabs TTS API, or fetching dynamic metadata) are directed to legitimate services or user-defined endpoints necessary for the skill's primary purpose.
Audit Metadata