remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill describes patterns for fetching and processing external data (JSON, SRT, Lottie files) that could be leveraged for indirect prompt injection.
- Ingestion points:
rules/calculate-metadata.md(fetching remote JSON),rules/display-captions.md(loading captions JSON),rules/import-srt-captions.md(parsing SRT subtitles), andrules/lottie.md(fetching animation data). - Boundary markers: The code examples do not provide delimiters or instructions to ignore commands that may be embedded in the retrieved data.
- Capability inventory: The skill utilizes subprocess execution for media tasks (
bunx remotion ffmpeginrules/ffmpeg.md) and file system writes for asset creation (fs.writeFileSyncinrules/transcribe-captions.md). - Sanitization: No data validation or sanitization logic is shown for the external content before it is processed by the application logic.
- [COMMAND_EXECUTION]:
rules/ffmpeg.mddocuments the use ofbunx remotion ffmpegandbunx remotion ffprobefor video trimming and metadata retrieval. - [EXTERNAL_DOWNLOADS]: The skill encourages the use of various external resources and services, including assets and documentation from well-known domains such as
remotion.dev,mapbox.com,elevenlabs.io, andlottiefiles.com.
Audit Metadata