remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Apr 13, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill describes patterns for fetching and processing external data (JSON, SRT, Lottie files) that could be leveraged for indirect prompt injection.
  • Ingestion points: rules/calculate-metadata.md (fetching remote JSON), rules/display-captions.md (loading captions JSON), rules/import-srt-captions.md (parsing SRT subtitles), and rules/lottie.md (fetching animation data).
  • Boundary markers: The code examples do not provide delimiters or instructions to ignore commands that may be embedded in the retrieved data.
  • Capability inventory: The skill utilizes subprocess execution for media tasks (bunx remotion ffmpeg in rules/ffmpeg.md) and file system writes for asset creation (fs.writeFileSync in rules/transcribe-captions.md).
  • Sanitization: No data validation or sanitization logic is shown for the external content before it is processed by the application logic.
  • [COMMAND_EXECUTION]: rules/ffmpeg.md documents the use of bunx remotion ffmpeg and bunx remotion ffprobe for video trimming and metadata retrieval.
  • [EXTERNAL_DOWNLOADS]: The skill encourages the use of various external resources and services, including assets and documentation from well-known domains such as remotion.dev, mapbox.com, elevenlabs.io, and lottiefiles.com.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 13, 2026, 12:01 PM